feat: samba password provisioning + caddy reverse proxy; rename user to darman

- systemd oneshot sets SMB password after samba-smbd (activation ran too early)
- caddy vhost reverse_proxy to whoami so :80 actually serves
- vm.nix: throwaway SMB secret for testing; real host uses sops/agenix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/vm.nix

@@ -13,10 +13,26 @@
   # Allow password login for testing (real host is key-only).
   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
 
-  # Login: erik / test  (change or remove for anything but local testing).
-  users.users.erik.initialPassword = "test";
+  # Login: darman / test  (change or remove for anything but local testing).
+  users.users.darman.initialPassword = "test";
   users.users.root.initialPassword = "test";
 
+  # Throwaway SMB password for testing (samba-smbd login = darman / test).
+  # Two lines: smbpasswd wants the new password + confirmation.
+  # Real host must NOT do this — plaintext lands in the world-readable Nix
+  # store. Use sops-nix/agenix to place /etc/samba/smb-password instead.
+  environment.etc."samba/smb-password" = {
+    text = ''
+      test
+      test
+    '';
+    mode = "0600";
+  };
+
   # Guest additions for clipboard/resize (optional).
   virtualisation.virtualbox.guest.enable = true;
+
+  # Smaller virtual disk = faster image assembly + VMDK compression.
+  # Size in MiB (default is ~50G).
+  virtualisation.diskSize = 6144;      # 6 GiB total disk
 }