Prestage a declarative wifi connection on the gui host

Adds modules/networking/wifi.nix using NetworkManager's ensureProfiles
mechanism so the gui host associates to a known SSID on first boot with
no manual nmtui step. Credentials are placeholders in variables.nix
(wifiSsid/wifiPassword, both empty) to be filled in once the bare-metal
hardware profile is wired up — the module is a no-op until then.

hosts/nixos/host.nix

@@ -1,6 +1,10 @@
 _:
 
 {
+  imports = [
+    ../../modules/networking/wifi.nix
+  ];
+
   networking.hostName = "nixos";
 
   # Preserved from the pre-refactor `nixos` target — stateVersion must never

modules/networking/wifi.nix

@@ -0,0 +1,26 @@
+{ lib, vars, ... }:
+
+{
+  # Prestages a NetworkManager connection profile for vars.wifiSsid/
+  # wifiPassword so the host associates on first boot with no manual
+  # nmtui/nmcli step. Guarded on a non-empty SSID so leaving the
+  # placeholders blank in variables.nix is a no-op rather than an empty,
+  # broken profile — fill both in once the bare-metal hardware profile is
+  # wired up.
+  networking.networkmanager.ensureProfiles.profiles = lib.mkIf (vars.wifiSsid != "") {
+    ${vars.wifiSsid} = {
+      connection = {
+        id = vars.wifiSsid;
+        type = "wifi";
+      };
+      wifi = {
+        mode = "infrastructure";
+        ssid = vars.wifiSsid;
+      };
+      wifi-security = {
+        key-mgmt = "wpa-psk";
+        psk = vars.wifiPassword;
+      };
+    };
+  };
+}

variables.nix

@@ -45,6 +45,13 @@
   # the installer image's nixos/root users.
   adminSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream";
 
+  # Prestaged wifi credentials for the gui host's NetworkManager profile
+  # (modules/networking/wifi.nix). Leave blank until the bare-metal
+  # hardware profile is wired up — an empty ssid disables the profile
+  # rather than creating a broken empty one.
+  wifiSsid = "";
+  wifiPassword = "";
+
   # System
   timeZone = "Australia/Brisbane";