feat: samba password provisioning + caddy reverse proxy; rename user to darman

- systemd oneshot sets SMB password after samba-smbd (activation ran too early)
- caddy vhost reverse_proxy to whoami so :80 actually serves
- vm.nix: throwaway SMB secret for testing; real host uses sops/agenix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -1,3 +1,6 @@
 result
 result-*
 .direnv/
+
+# built artifacts
+*.ova