Initial flake: muscari k3s host

- flake.nix: mkHost helper, SOPS-age integration
- hosts/common: locale, sshd, universal packages
- hosts/muscari: k3s host with Cilium flags
- modules/users/mikl: SSH keys via forgejo .keys + sha256 pinning
- modules/services/k3s: k3s daemon with Cilium-compatible flags
- hardware-configuration.nix: placeholder, will be regenerated on real VM

Stack:
- NixOS 25.11
- k3s single-node (Cilium CNI, Traefik ingress)
- SOPS + age for secrets
- Multi-host ready (rosemary planned)

hosts/common/default.nix

@@ -0,0 +1,43 @@
+# Common config for ALL NixOS hosts (muscari, future rosemary, ...)
+# Только то что реально нужно везде. Специфичное для k3s/forgejo — в modules/services/
+
+{ pkgs, ... }:
+{
+  # Time
+  time.timeZone = "Europe/Moscow";
+
+  # Locale
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # SSH — единые правила для всех хостов
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+    };
+  };
+
+  # Базовые пакеты — есть на каждом хосте
+  environment.systemPackages = with pkgs; [
+    # shell + tools
+    git
+    neovim
+    htop
+    tmux
+    curl
+    wget
+    rsync
+    dnsutils       # dig, nslookup
+
+    # secrets
+    sops
+    age
+    ssh-to-age
+
+    # nix tooling
+    nh              # nix-helper от vlaci, удобнее чем nixos-rebuild switch
+    shellcheck
+    shfmt
+  ];
+}