Initial flake: muscari k3s host

- flake.nix: mkHost helper, SOPS-age integration
- hosts/common: locale, sshd, universal packages
- hosts/muscari: k3s host with Cilium flags
- modules/users/mikl: SSH keys via forgejo .keys + sha256 pinning
- modules/services/k3s: k3s daemon with Cilium-compatible flags
- hardware-configuration.nix: placeholder, will be regenerated on real VM

Stack:
- NixOS 25.11
- k3s single-node (Cilium CNI, Traefik ingress)
- SOPS + age for secrets
- Multi-host ready (rosemary planned)

.gitignore

@@ -0,0 +1,24 @@
+# Nix build artifacts
+result
+result-*
+
+# secrets — НЕ коммитим незашифрованные
+# (зашифрованные через SOPS — коммитятся)
+*.plain.yaml
+*.plain.yml
+
+# editor backups
+*.swp
+*.bak
+*~
+.DS_Store
+
+# nix tooling
+.direnv/
+devenv.nix
+devenv.yaml
+
+# age key (НИКОГДА не коммитить!)
+*.age-key
+*age-keys.txt
+*age-keys.json