fix(ipa): add wheel group to IPA user stub for sudo access

initgroups() uses NSS (groups: files sss) to build the supplemental
group list at login. Adding wheel to the local users.users stub means
the IPA user gets wheel membership from /etc/group, satisfying sudo's
group check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ipa/client.nix

@@ -140,6 +140,7 @@ lib.mkIf enabled {
   users.users.${vars.ipaUser} = {
     isNormalUser = true;
     group = "users";
+    extraGroups = [ "wheel" ];
     createHome = false;
   };