refactor(ipa): move FreeIPA client to common config with auto-enrollment

modules/ipa/client.nix is now a self-contained NixOS module (no longer a
parameterized function): it checks builtins.pathExists for
secrets/<hostname>.keytab at eval time and enables itself automatically if
found, making it a no-op for hosts without a keytab.

modules/common/configuration.nix imports it so every host in the flake is
a candidate for IPA enrollment — no per-host wiring needed. Adding a
keytab (via scripts/ipa/create-nixos-ipa-host-account.sh) is now the
only step required to enroll a host.

The module also sets networking.domain and networking.nameservers via
mkDefault when active, so new hosts don't need those set explicitly.

Also:
- Remove explicit IPA imports from hosts/nix-cache and hosts/tailscale-router
- Add secrets/pxe-boot.keytab + creation rule; remove incorrect
  secrets/nixos.sweet.home.keytab and its creation rule
- Add .sops.yaml creation rules for all remaining host keytabs
  (server, docker, tor-relay, nix-minimal, nixos) so the creation script
  can target them without manual .sops.yaml edits
- Fix duplicate tailscale-router.keytab rule and corrupted gui.yaml comment
  block in .sops.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ipa/client.nix

@@ -1,34 +1,15 @@
 # Fully declarative FreeIPA domain membership.
 #
-# Configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a
-# pre-provisioned host keytab via sops-nix so no imperative ipa-client-install
-# step is needed after deployment.
+# Imported by modules/common/configuration.nix — no per-host wiring needed.
+# Enables itself automatically on any host that has a sops-encrypted keytab
+# at secrets/<hostname>.keytab; is a no-op for all other hosts.
 #
-# Usage (in a host.nix imports list):
-#   (import ../../modules/ipa/client.nix {
-#     keytabSopsFile = ../../secrets/<hostname>.keytab;
-#     caCertFile     = ../../certs/ipa-ca.crt;  # already committed — do not re-fetch
-#   })
-#
-# The host.nix networking block must also set:
-#   networking.domain   = vars.homeDomain;         # needed for Kerberos FQDN
-#   networking.nameservers = [ vars.domainControllerIp ];  # IPA DNS
-#
-# One-time operator setup per host (do this BEFORE deploying):
-#
-#   0. Generate SSH host keys and the host's age key for sops:
-#        scripts/secrets/sync-host-keys.sh <flake-target>
-#      This must run before step 1 so the host age key is in .sops.yaml
-#      and the keytab can be encrypted for the host to read at boot.
-#
-#   1. Add the IPA host account and produce the sops-encrypted keytab:
-#        scripts/ipa/create-nixos-ipa-host-account.sh [--ip <addr>] <hostname>
-#      The script handles ipa host-add, ipa-getkeytab, .sops.yaml patching,
-#      and sops encryption in one step. See the script header for details.
-#
-#   2. Wire up the host (see "Usage" above), then deploy:
-#        nixos-rebuild switch  (or create-proxmox-resource.sh)
-#      No further manual enrollment steps are required after deployment.
+# To enroll a new host:
+#   0. scripts/secrets/sync-host-keys.sh <flake-target>
+#   1. scripts/ipa/create-nixos-ipa-host-account.sh [--ip <addr>] <hostname>
+#      (adds .sops.yaml rule, runs ipa host-add, encrypts keytab in one step)
+#   2. git add secrets/<hostname>.keytab .sops.yaml && git commit
+#   3. Deploy — no further steps required.
 #
 # Manual fallback (if the script isn't usable):
 #   a. On the FreeIPA server: ipa host-add <fqdn> [--ip-address=<ip>] --force
@@ -40,18 +21,23 @@
 #
 # vars dependencies: homeDomain, ipaServer, domainControllerIp
 
-{ keytabSopsFile, caCertFile }:
 { config, lib, pkgs, vars, ... }:
 
 let
+  keytabPath = ../../secrets + "/${config.networking.hostName}.keytab";
+  enabled = builtins.pathExists keytabPath;
+
   realm = lib.strings.toUpper vars.homeDomain;
   fqdn = "${config.networking.hostName}.${vars.homeDomain}";
   # "sweet.home" -> "dc=sweet,dc=home"
   basedn = lib.strings.concatMapStringsSep "," (c: "dc=${c}") (lib.strings.splitString "." vars.homeDomain);
   # security.ipa.certificate expects a derivation (package), not a raw path.
-  caCertPkg = pkgs.writeText "ipa-ca.crt" (builtins.readFile caCertFile);
+  caCertPkg = pkgs.writeText "ipa-ca.crt" (builtins.readFile ../../certs/ipa-ca.crt);
 in
-{
+lib.mkIf enabled {
+  networking.domain = lib.mkDefault vars.homeDomain;
+  networking.nameservers = lib.mkDefault [ vars.domainControllerIp ];
+
   security.ipa = {
     enable = true;
     domain = vars.homeDomain;
@@ -92,7 +78,7 @@ in
   # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
   # to IPA without running ipa-client-install.
   sops.secrets."ipa-host-keytab" = {
-    sopsFile = keytabSopsFile;
+    sopsFile = keytabPath;
     format = "binary";
     path = "/etc/krb5.keytab";
     owner = "root";