skydick: switch Samba to ldapsam, rename ylw→ye-lw21, drop legacy datasets ...

- Samba passdb backend changed from tdbsam to ldapsam:ldap://10.0.0.1
- Added samba-ldap-admin-password oneshot to seed LDAP admin cred before smbd
- Pinned storage group to GID 997 to match LDAP posixGroup
- Renamed ylw to ye-lw21 across all hosts (users.nix, skydick, xlab-gateway)
- Removed legacy tmpfiles and NFS exports (share/backup/torrent/vm destroyed)
- Added bootstrap LDIF for sambaDomain, storage group, machines OU

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: equalize ldx and ylw permissions ...

- Add ylw to NOPASSWD sudo rule (matching ldx for deploy-rs)
- Add ldx hashedPassword on xlab-gateway (matching ylw)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: unify ylw as common admin, keep host-specific passwords and groups ...

Move ylw base identity (isNormalUser, wheel, SSH key) to modules/users.nix
alongside ldx. Host configs retain only extra groups and hashedPassword.
Also renames ye-lw21 to ylw on skydick.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: grant ldx full NOPASSWD sudo for deploy-rs ...

deploy-rs runs activate-rs, nix-env, switch-to-configuration, and
confirmation commands through separate non-interactive SSH sessions.
Per-command NOPASSWD rules cannot cover all paths it uses. Full
NOPASSWD is the intended deploy-rs setup.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

add systemctl and reboot to NOPASSWD sudo rules ...

Needed for restarting services (systemd-networkd, nftables) after
deploy when switch-to-configuration doesn't detect unit changes.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add switch-to-configuration to NOPASSWD sudo rules ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add skydick SSH key, set xlab-gateway deploy to LAN IP ...

- Authorize ldx@skydick ed25519 key for cross-machine deploy-rs
- Change xlab-gateway deploy hostname to 10.253.254.1 (LAN, reachable
  from skydick)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

deploy-rs: update xlab-gateway hostname, add NOPASSWD sudo ...

- Change xlab-gateway deploy hostname to WAN IP (166.111.98.29)
- Add NOPASSWD sudo rules for deploy-rs activation commands
  (nix-env, activate scripts)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>