refactor xlab-gateway IPv6: /64 SLAAC, scoped policy routing, no NAT66 ...

- Change LAN prefix from fd99:23eb:1682:fd:df::/80 to fd99:23eb:1682:1::/64
- Switch from DHCPv6 stateful to SLAAC (AdvAutonomous on, AdvManagedFlag off)
- Add RDNSS in radvd pointing to fd99:23eb:1682::1
- Scope policy routing rules to LAN sources only (fixes gateway IPv6 breakage)
- Remove NAT66 masquerade on wg-to-wgnet (10.0.0.1 routes fd99:23eb:1682:1::/64 natively)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>