feat: samba password provisioning + caddy reverse proxy; rename user to darman

- systemd oneshot sets SMB password after samba-smbd (activation ran too early)
- caddy vhost reverse_proxy to whoami so :80 actually serves
- vm.nix: throwaway SMB secret for testing; real host uses sops/agenix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1783703440,
+        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}