feat: scaffold mercury (rpi 3b+ aarch64 SD image) for DNS/DHCP

- nixosConfigurations.mercury: aarch64, sd-image-aarch64, imports common.nix
- static net placeholders (CHANGE-ME), hostname mercury
- DNS service left undecided: commented pihole (services.pihole-ftl) + adguardhome
- no sops yet (add with the service if it needs a secret)

flake.nix

@@ -46,6 +46,19 @@
           ];
         };
 
+        # mercury — Raspberry Pi 3B+ (aarch64), DNS/DHCP. Boots from an SD image:
+        #   nix build .#nixosConfigurations.mercury.config.system.build.sdImage
+        # (aarch64 build — needs binfmt/qemu on this x86 host, or a remote/aarch64
+        # builder; substitutes most paths from cache.nixos.org.)
+        mercury = nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+            ./hosts/mercury/configuration.nix
+          ];
+        };
+
         # VirtualBox test image. Build the OVA with:
         #   nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
         # NOTE: no disko here — the virtualbox-image module supplies the disk.