infra: harden xlab and skydick networking

xlab/kea: pin AP wired MTU to 1420 (interface-mtu) so CAPWAP joins over WG ...

The 3802 sends 1441-byte DF DTLS packets to the WLC and ignores PMTUD
frag-needed (mtu 1420), so the join blackholes on the 1420 wg-to-wgnet tunnel
and cycles every 30s. Add DHCP option-26 interface-mtu=1420 to the cisco-ap
class so APs cap their wired MTU and never exceed the path MTU.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab/kea: announce Cisco WLC 10.0.10.10 via DHCP option 43 (cisco-ap class) ...

Mirrors door1's kea-dhcp4 cisco-ap client-class so remote APs on the lab
(10.253.254.0/24) discover the Catalyst 9800-CL WMI: option-60 "Cisco AP*"
clients get vendor-encapsulated-options F1:04:0A:00:0A:0A (opt43 sub-opt 241).
Both scopes already hand out domain dev.skyw.top + DNS 10.0.0.1; the
CISCO-CAPWAP-CONTROLLER.dev.skyw.top A record (10.0.10.10) is the DNS-discovery
backup. Lab->WLC reachability over wg-to-wgnet confirmed (1.24ms).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Update dhcp.nix

Update dhcp.nix

fix syntax error

make sure DHCP start after interface initialization

refactor xlab-gateway IPv6: /64 SLAAC, scoped policy routing, no NAT66 ...

- Change LAN prefix from fd99:23eb:1682:fd:df::/80 to fd99:23eb:1682:1::/64
- Switch from DHCPv6 stateful to SLAAC (AdvAutonomous on, AdvManagedFlag off)
- Add RDNSS in radvd pointing to fd99:23eb:1682::1
- Scope policy routing rules to LAN sources only (fixes gateway IPv6 breakage)
- Remove NAT66 masquerade on wg-to-wgnet (10.0.0.1 routes fd99:23eb:1682:1::/64 natively)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>