feat: scaffold netcup vps host (disko/vda, static net, tailscale, caddy)

- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda
- static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS
- tailscale via headscale + sops authkey (secrets/vps.yaml, own host key)
- caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000
- shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules

common.nix

@@ -0,0 +1,41 @@
+{ pkgs, ... }:
+
+# Shared base for all hosts: user, SSH hardening, nix settings, packages.
+# (jupiter still carries its own copy in services.nix; vps uses this.)
+{
+  # ---- User ----
+  users.users.darman = {
+    isNormalUser = true;
+    description = "darman";
+    extraGroups = [ "wheel" "networkmanager" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
+    ];
+  };
+  security.sudo.wheelNeedsPassword = false;
+
+  # ---- SSH (key-only) ----
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # ---- Nix ----
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    # trust wheel so `nixos-rebuild --target-host darman@…` can push closures.
+    trusted-users = [ "root" "@wheel" ];
+  };
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+  environment.systemPackages = with pkgs; [ vim git htop tmux curl ];
+
+  i18n.defaultLocale = "en_US.UTF-8";
+}