Add baremetal-gui flake target with ZFS RAID0, AMD GPU, and sops-backed wifi

Wires everything staged so far into a real flake target:

- modules/platforms/baremetal.nix (new): the bare-metal platform module,
  composed from a real nixos-generate-config run on the actual gui-host
  hardware (AMD CPU, ahci/xhci/usb storage -- modules/hardware-configuration/baremetal.nix).
  Enables hardware.enableRedistributableFirmware (real wifi/GPU/microcode
  firmware VMs never needed), amdgpu as the Xorg video driver plus
  hardware.graphics for Mesa OpenGL/Vulkan, and imports the ZFS RAID0 disko
  layout + modules/services/zfs/enable-service.nix for root-on-ZFS boot
  support.
- flake.nix: new baremetal-gui target, reusing hosts/nixos/host.nix (same
  identity already shared across linode/proxmox/lxc-gui).
- hosts/nixos/host.nix: added networking.hostId, required now that a ZFS
  root pool is in the picture.
- variables.nix: guiRootDisk1/guiRootDisk2 filled in (/dev/sda, /dev/sdb --
  only used transiently at disko-format time, same as modules/disko/proxmox.nix's
  own plain device path). wifiPassword removed.
- modules/networking/wifi.nix: reworked to pull the wifi password from a
  new sops secret (secrets/gui.yaml, wifi-password) instead of a plaintext
  variable -- NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"`
  literally (nixpkgs' own documented pattern for this) and envsubst-expands
  it from a sops-rendered EnvironmentFile at activation, so the real value
  never touches the Nix store, only /run.
- .sops.yaml: new secrets/gui\.yaml rule, admin + the currently-registered
  lxc-gui recipient (the only gui variant with a provisioned host key so
  far -- whichever variant is actually deployed next still needs
  scripts/secrets/sync-host-keys.sh run for its own recipient).
- README.md/CLAUDE.md: documented the new platform/target and its module
  layout, per this repo's own drift-prevention note.

Verified end-to-end: nix eval of every existing target (nothing broke),
a temporary real nixosSystem build against the actual disko.nixosModules.disko
confirming the generated zpool create has no mirror/raidz keyword (genuine
stripe), and a temporary test SSID confirming the sops secret/template/
ensureProfiles chain renders correctly before reverting to blank/real values.
Full scripts/codex-maintenance.sh (secret-grep, fmt, statix, full-fallback
eval of every host/package) passes clean.

CLAUDE.md

@@ -321,11 +321,14 @@ nixosSystem {
 }
 ```
 
-Platforms: `linode`, `proxmox`, `lxc`. Build types: `minimal`, `nix-cache`,
-`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`. Not
-every combination is built — e.g. `pxe-boot` has no `linode` variant
-(PXE/DHCP/TFTP need LAN L2 adjacency a Linode VPS doesn't have), and
-`tor-relay` currently only exists as `lxc-tor-relay`. Treat `flake.nix`'s
+Platforms: `linode`, `proxmox`, `lxc`, `baremetal`. Build types: `minimal`,
+`nix-cache`, `server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`,
+`tor-relay`. Not every combination is built — e.g. `pxe-boot` has no `linode`
+variant (PXE/DHCP/TFTP need LAN L2 adjacency a Linode VPS doesn't have),
+`tor-relay` currently only exists as `lxc-tor-relay`, and `baremetal`
+currently only exists as `baremetal-gui` (the real gui-host hardware —
+see `hosts/nixos/host.nix` and `modules/platforms/baremetal.nix`). Treat
+`flake.nix`'s
 `generatedTargets` as the source
 of truth for which hosts exist — `README.md`, `AGENTS.md`,
 `docs/flake-lock-automation.md`, and the CI eval workflows
@@ -341,12 +344,16 @@ removing a host.
   of their own beyond narrow parameterized helpers (see
   `modules/beszel/host-token.nix` below) — all shared behavior comes from the
   platform/build-type modules composed in `flake.nix`, not from the host file.
-- `modules/platforms/{linode,proxmox,lxc}.nix` — platform-specific config:
-  boot method, guest tooling, and (for linode/proxmox) the hypervisor-specific
-  hardware config, imported directly by the platform module itself
-  (`../hardware-configuration/vm/{proxmox,linode}.nix`) — **not** wired in
-  from `flake.nix`. `lxc.nix` has no hardware-configuration counterpart since
-  containers share the host kernel; instead it imports nixpkgs' own
+- `modules/platforms/{linode,proxmox,lxc,baremetal}.nix` — platform-specific
+  config: boot method, guest tooling, and the hardware config, imported
+  directly by the platform module itself — **not** wired in from
+  `flake.nix`. VM platforms use `../hardware-configuration/vm/{proxmox,linode}.nix`;
+  `baremetal.nix` uses `../hardware-configuration/baremetal.nix` (adapted
+  from a real `nixos-generate-config` run on the actual hardware, not a
+  vm/ file, since it isn't a VM) plus `hardware.enableRedistributableFirmware
+  = true` for real wifi/GPU/microcode firmware that VMs never needed.
+  `lxc.nix` has no hardware-configuration counterpart since containers
+  share the host kernel; instead it imports nixpkgs' own
   `virtualisation/proxmox-lxc.nix`, which gives every `lxc-*` host a
   `config.system.build.tarball` output — a plain rootfs tarball, used as a
   `pct create ... vztmpl` CT template (**not** `pct restore`, which expects
@@ -370,6 +377,16 @@ removing a host.
   boots, so this declares them with `destroy = false` (disko never wipes
   them) and a bare `filesystem`/`swap` content type instead of a partition
   table — idempotent against an already-provisioned disk, never destructive.
+- `modules/disko/baremetal.nix` — `baremetal-gui`'s disko config: a ZFS
+  RAID0 (striped, no redundancy — disko's zpool `mode` defaults to `""`,
+  which is a plain stripe rather than `"mirror"`/`"raidz"`) root pool
+  across two disks, ESP + systemd-boot on the first. Device paths
+  (`vars.guiRootDisk1`/`guiRootDisk2`) are placeholders — fill in stable
+  `/dev/disk/by-id/...` paths before running disko for real.
+  `modules/platforms/baremetal.nix` also imports
+  `modules/services/zfs/enable-service.nix` for this (the `zfs_unstable`
+  package, autoScrub/autoSnapshot/trim) — the only other importer today is
+  `server`'s NFS data pool, an unrelated non-root ZFS use.
 - `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module.
 - `modules/installer/` — the auto-installer environment (ISO, also served as
   PXE netboot): `common.nix` (shared config + the generated