fix(pxe-boot): move dnsmasq out of systemd.services into services.dnsmasq

dnsmasq config was placed inside systemd.services{} block, making Nix
interpret it as systemd.services.dnsmasq.settings (which doesn't exist).
Move to top-level services.dnsmasq and add UDP 67 to firewall for DHCP
proxy mode.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/pxe-boot.nix

@@ -417,19 +417,19 @@ in
           ExecStart = stageSystemRescue;
         };
       };
-      dnsmasq = {
+    };
+  };
+
+  services.dnsmasq = {
     enable = true;
     settings = {
-          # Proxy mode: respond only to PXE DHCP requests, leave normal leases to router
       dhcp-range = [ "192.168.2.0,proxy" ];
-          # iPXE client detection
       dhcp-match = [
         "set:ipxe,175"
         "set:efi64,option:client-arch,7"
         "set:efi64,option:client-arch,9"
       ];
       dhcp-userclass = "set:ipxe,iPXE";
-          # Boot file selection
       dhcp-boot = [
         "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
         "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
@@ -438,9 +438,7 @@ in
       ];
     };
   };
-    };
-  };
 
   networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
-  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ];
 }