feat: scaffold netcup vps host (disko/vda, static net, tailscale, caddy)

- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda
- static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS
- tailscale via headscale + sops authkey (secrets/vps.yaml, own host key)
- caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000
- shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules

flake.nix

@@ -35,6 +35,17 @@
           ];
         };
 
+        # netcup VPS — public reverse proxy + tailnet node.
+        vps = nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit inputs; };
+          modules = [
+            disko.nixosModules.disko
+            sops-nix.nixosModules.sops
+            ./vps/configuration.nix
+          ];
+        };
+
         # VirtualBox test image. Build the OVA with:
         #   nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
         # NOTE: no disko here — the virtualbox-image module supplies the disk.