initial scaffold: multi-host flake (poppy, muscari, rosemary)

- flake.nix with mkNixos + mkDarwin dispatchers
- hosts/common/{default.nix} (NixOS shared)
- hosts/common-darwin/{default.nix} (darwin shared)
- hosts/poppy/ (M1 MacBook Air, nix-darwin)
- hosts/muscari/ (k3s server, placeholder)
- hosts/rosemary/ (backup VM, placeholder)
- home/default.nix (home-manager for mikl)
- README.md, garden.md (host naming scheme: plants)
- secrets/.gitkeep

old muscari-only config moved to nix-config-legacy/

garden.md

@@ -0,0 +1,32 @@
+# garden
+
+Hosts in this repo are named after plants and flowers.
+
+## hosts
+
+### poppy *(active)*
+- **role:** MacBook Air M1, personal/work machine
+- **system:** nix-darwin, aarch64-darwin
+- **location:** daily driver
+
+### muscari *(planned migration)*
+- **role:** linux server, k3s cluster
+- **system:** NixOS, x86_64-linux
+- **location:** iscg infra
+
+### rosemary *(planned)*
+- **role:** backup VM
+- **system:** NixOS, x86_64-linux
+
+## structure
+
+- `flake.nix` — entry point, dispatches `mkNixos` and `mkDarwin` per host
+- `hosts/<name>/default.nix` — per-host config
+- `hosts/common/default.nix` — shared NixOS config
+- `hosts/common-darwin/default.nix` — shared darwin config
+- `home/default.nix` — shared home-manager config for user `mikl`
+- `secrets/` — sops-encrypted secrets per host
+
+## migrations
+
+- `nix-config-legacy/` — previous muscari-only config (preserved for reference)