feat(mesh): add Sol-style lilac client pool

hosts/heather/default.nix

@@ -21,6 +21,7 @@
     ./syncthing.nix       # sync + relay
     ./tuwunel-admin.nix   # matrix admin web UI (systemd, статический бинарник)
     ./pi-web.nix          # pi-web (web UI для pi coding agent, systemd + npm global)
+    ./mesh-clients.nix    # Sol-style client pool (wg-clients1)
   ];
 
   # First server-to-server WireGuard backbone link: heather ↔ hyacinth.

hosts/heather/mesh-clients.nix

@@ -0,0 +1,42 @@
+# Sol-style client pool for personal mesh.
+# Backbone peers use wg-mesh; phones/laptops use this separate interface.
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.wireguard-tools ];
+
+  networking.wireguard.interfaces.wg-clients1 = {
+    ips = [ "10.0.1.1/24" ];
+    listenPort = 51821;
+    privateKeyFile = "/var/lib/wireguard/wg-clients1.key";
+    allowedIPsAsRoutes = false;
+    peers = [
+      {
+        # lilac (Pixel 9 Pro), generated on poppy; private key is not in git.
+        publicKey = "RAvcRTdFBcvAGZWRm6YBMjRHRGj0iMNxsE0MBPGUPjM=";
+        allowedIPs = [ "10.0.1.10/32" ];
+      }
+    ];
+  };
+
+  networking.firewall.allowedUDPPorts = [ 51821 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/wireguard 0700 root root -"
+  ];
+
+  # Generate the server key on first activation, outside the Nix store.
+  systemd.services.wireguard-key-wg-clients1 = {
+    description = "Generate wg-clients1 private key if absent";
+    wantedBy = [ "wireguard-wg-clients1.service" ];
+    before = [ "wireguard-wg-clients1.service" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      install -d -m 700 /var/lib/wireguard
+      if [ ! -s /var/lib/wireguard/wg-clients1.key ]; then
+        umask 077
+        ${pkgs.wireguard-tools}/bin/wg genkey > /var/lib/wireguard/wg-clients1.key
+        chmod 600 /var/lib/wireguard/wg-clients1.key
+      fi
+    '';
+  };
+}