feat: scaffold netcup vps host (disko/vda, static net, tailscale, caddy)

- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda
- static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS
- tailscale via headscale + sops authkey (secrets/vps.yaml, own host key)
- caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000
- shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules

vps/hardware-configuration.nix

@@ -0,0 +1,23 @@
+# PLACEHOLDER — replace on install.
+#
+# disko (disk-config.nix) owns the filesystems, so this file only carries
+# kernel modules + platform. nixos-anywhere regenerates it via:
+#   nixos-generate-config --no-filesystems
+# Keep the imports/kernel-module lines; the virtio modules are pinned in
+# configuration.nix so root mounts even if the generator misses them.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_blk" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # NO fileSystems here — disko defines "/" and "/boot".
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}