feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/session/desktop.nix

@@ -0,0 +1,80 @@
+# roles/thin-client/session/desktop.nix
+#
+# KDE Plasma 6 on Wayland, SDDM display manager.
+# Q6 decisions: Wayland, no autologin, Full-HD uniform monitors.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) mkIf;
+  cfg = config.az.tc;
+in {
+  config = mkIf cfg.enable {
+    # Xserver base — required for keyboard config even on Wayland.
+    services.xserver.enable = true;
+
+    services.displayManager = {
+      sddm = {
+        enable = true;
+        wayland.enable = true;
+        autoNumlock = true;
+        settings = {
+          Theme = {
+            # Branded theme set in branding.nix
+            CursorTheme = "breeze_cursors";
+          };
+          Autologin = {
+            # Explicitly disabled — multi-user machine.
+            User = "";
+            Session = "";
+          };
+        };
+      };
+      defaultSession = "plasma";
+    };
+
+    services.desktopManager.plasma6 = {
+      enable = true;
+    };
+
+    # Wayland portal for screen capture (RustDesk + OBS).
+    xdg.portal = {
+      enable = true;
+      extraPortals = [
+        pkgs.kdePackages.xdg-desktop-portal-kde
+      ];
+      config.common.default = ["kde"];
+    };
+
+    # PipeWire for audio (RustDesk/OBS/Chrome all consume it).
+    security.rtkit.enable = true;
+
+    # German keyboard layout
+    services.xserver.xkb = {
+      layout = "de";
+      variant = "";
+      options = "eurosign:e";
+    };
+
+    # Essential KDE/PIM utilities users expect
+    environment.plasma6.excludePackages = with pkgs.kdePackages; [
+      konsole
+      elisa
+      khelpcenter
+    ];
+
+    environment.systemPackages = with pkgs; [
+      # Thin-client baseline utilities
+      kitty
+      ark
+      kdePackages.kcalc
+      kdePackages.spectacle
+      kdePackages.filelight
+    ];
+
+    # Firewall UI helper (KDE) — optional but useful for support staff
+    # networking.firewall is configured in network/firewall.nix
+  };
+}