refactor(ipa): move FreeIPA client to common config with auto-enrollment

modules/ipa/client.nix is now a self-contained NixOS module (no longer a
parameterized function): it checks builtins.pathExists for
secrets/<hostname>.keytab at eval time and enables itself automatically if
found, making it a no-op for hosts without a keytab.

modules/common/configuration.nix imports it so every host in the flake is
a candidate for IPA enrollment — no per-host wiring needed. Adding a
keytab (via scripts/ipa/create-nixos-ipa-host-account.sh) is now the
only step required to enroll a host.

The module also sets networking.domain and networking.nameservers via
mkDefault when active, so new hosts don't need those set explicitly.

Also:
- Remove explicit IPA imports from hosts/nix-cache and hosts/tailscale-router
- Add secrets/pxe-boot.keytab + creation rule; remove incorrect
  secrets/nixos.sweet.home.keytab and its creation rule
- Add .sops.yaml creation rules for all remaining host keytabs
  (server, docker, tor-relay, nix-minimal, nixos) so the creation script
  can target them without manual .sops.yaml edits
- Fix duplicate tailscale-router.keytab rule and corrupted gui.yaml comment
  block in .sops.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.sops.yaml

@@ -63,16 +63,6 @@ creation_rules:
           - *lxc-nix-cache
           - *proxmox-nix-cache
 
-  # Host keytab for nix-cache FreeIPA enrollment (binary sops file).
-  # Generate with: sops -e --input-type binary /tmp/nix-cache.keytab > secrets/nix-cache.keytab
-  - path_regex: secrets/nix-cache\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *linode-nix-cache
-          - *lxc-nix-cache
-          - *proxmox-nix-cache
-
   - path_regex: secrets/server\.yaml$
     key_groups:
       - age:
@@ -127,16 +117,6 @@ creation_rules:
   # scripts/secrets/sync-host-keys.sh yet, so whichever variant is actually
   # deployed next needs its recipient added here (and `sops updatekeys` rerun)
   # before it can decrypt this.
-  # Host keytab for tailscale-router FreeIPA enrollment (binary sops file).
-  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
-  - path_regex: secrets/tailscale-router\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *lxc-tailscale-router
-          - *proxmox-tailscale-router
-          - *linode-tailscale-router
-
   - path_regex: secrets/gui\.yaml$
     key_groups:
       - age:
@@ -146,19 +126,72 @@ creation_rules:
           - *linode-gui
           - *proxmox-gui
 
-  # Host keytab for tailscale-router FreeIPA enrollment (binary sops file).
-  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  # IPA host keytabs (binary sops files).
+  # Each keytab is encrypted for all platform variants of that host so any
+  # deployed variant can decrypt it at boot. Run
+  # scripts/ipa/create-nixos-ipa-host-account.sh <hostname> to enroll a new
+  # host and produce the keytab; this section is updated by that script.
+
+  - path_regex: secrets/nix-cache\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *linode-nix-cache
+          - *lxc-nix-cache
+          - *proxmox-nix-cache
+
   - path_regex: secrets/tailscale-router\.keytab$
     key_groups:
       - age:
           - *admin
+          - *linode-tailscale-router
           - *lxc-tailscale-router
           - *proxmox-tailscale-router
-          - *linode-tailscale-router
 
-  # Host keytab for nixos.sweet.home FreeIPA enrollment (binary sops file).
-  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
-  - path_regex: secrets/nixos.sweet.home\.keytab$
+  - path_regex: secrets/pxe-boot\.keytab$
     key_groups:
       - age:
           - *admin
+          - *lxc-pxe-boot
+          - *proxmox-pxe-boot
+
+  # nixos = the workstation (hosts/nixos/host.nix). All gui platform variants
+  # share the hostname "nixos" and must be able to decrypt at boot.
+  - path_regex: secrets/nixos\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *baremetal-gui
+          - *lxc-gui
+          - *proxmox-gui
+          - *linode-gui
+
+  - path_regex: secrets/server\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *linode-server
+          - *lxc-server
+          - *proxmox-server
+
+  - path_regex: secrets/docker\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *linode-docker
+          - *lxc-docker
+          - *proxmox-docker
+
+  - path_regex: secrets/tor-relay\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *lxc-tor-relay
+
+  - path_regex: secrets/nix-minimal\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *lxc-minimal
+          - *proxmox-minimal
+          - *linode-minimal