Switch LXC targets from NetworkManager to systemd-networkd

boot.isContainer disables services.udev, which NetworkManager depends on
to enumerate devices — this left NM unable to reliably manage the
container veth, breaking DHCP-hostname registration in Pi-hole. It also
defaulted networking.useHostResolvConf to true, which assumes a
systemd-nspawn-style resolv.conf bind-mount that real Proxmox LXC doesn't
provide (nixpkgs' own proxmox-lxc.nix module forces this false for the
same reason). Also guard the networkmanager extraGroups membership in the
minimal/gui build-types, since that group only exists when NM is enabled.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/platforms/lxc.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   boot.isContainer = true;
@@ -11,4 +11,20 @@
   # file doesn't correctly launch the current generation, so even a
   # correctly-installed system can fail to come up after reboot.
   boot.loader.initScript.enable = true;
+
+  # boot.isContainer disables services.udev (see nixpkgs'
+  # virtualisation/container-config.nix), and NetworkManager depends on a
+  # running udevd to enumerate/classify devices. That leaves NM unable to
+  # reliably manage the container's veth interface, which is what broke
+  # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
+  # kernel over rtnetlink directly and doesn't have that dependency.
+  networking.networkmanager.enable = lib.mkForce false;
+  networking.useNetworkd = true;
+
+  # container-config.nix also defaults this to true, which assumes a
+  # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
+  # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
+  # forces this false for the same reason), so leaving it true silently
+  # breaks DNS instead of falling back to networkd/DHCP-provided servers.
+  networking.useHostResolvConf = lib.mkForce false;
 }