feat(ipa/docker): grant docker access via IPA group membership

Create an IPA group "docker-access" (GID 50010) and pin the local
"docker" group to that GID on all Docker hosts.  Any IPA user in the
docker-access group automatically gains docker socket access through
SSSD supplementary-group resolution — no per-host docker.members
entry needed.

Specific changes:
- variables.nix: add dockerAccessGid = 50010
- modules/docker/enable-service.nix: lib.mkForce docker GID to
  dockerAccessGid, removing the need to name individual IPA users
- modules/build-types/docker.nix: remove direct wayne docker.members
  entry (access now comes from IPA group)
- modules/ipa/client.nix: refactor repeated security.* / systemd.*
  top-level keys into merged attribute sets (fixes statix W20); add
  security.pam.services.lightdm.makeHomeDir so the GUI login path
  also creates the home dir on first login

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

variables.nix

@@ -85,6 +85,12 @@
   # that IPA itself doesn't cover: dotfiles, user packages, session variables.
   ipaUser = "wayne";
 
+  # GID of the IPA "docker-access" group (GID 50010 on the IPA server).
+  # The local "docker" group is pinned to this GID on every host that runs
+  # Docker so that IPA group membership alone grants docker socket access -
+  # no per-host users.groups.docker.members entry for the IPA user needed.
+  dockerAccessGid = 50010;
+
   # HA file server cluster
   # LAN IPs (vmbr0 / ens18) — client-facing: iSCSI initiators, NFS, management.
   # Storage IPs (vmbr1 / ens19) — isolated internal bridge, used for DRBD