Add baremetal-gui flake target with ZFS RAID0, AMD GPU, and sops-backed wifi

Wires everything staged so far into a real flake target:

- modules/platforms/baremetal.nix (new): the bare-metal platform module,
  composed from a real nixos-generate-config run on the actual gui-host
  hardware (AMD CPU, ahci/xhci/usb storage -- modules/hardware-configuration/baremetal.nix).
  Enables hardware.enableRedistributableFirmware (real wifi/GPU/microcode
  firmware VMs never needed), amdgpu as the Xorg video driver plus
  hardware.graphics for Mesa OpenGL/Vulkan, and imports the ZFS RAID0 disko
  layout + modules/services/zfs/enable-service.nix for root-on-ZFS boot
  support.
- flake.nix: new baremetal-gui target, reusing hosts/nixos/host.nix (same
  identity already shared across linode/proxmox/lxc-gui).
- hosts/nixos/host.nix: added networking.hostId, required now that a ZFS
  root pool is in the picture.
- variables.nix: guiRootDisk1/guiRootDisk2 filled in (/dev/sda, /dev/sdb --
  only used transiently at disko-format time, same as modules/disko/proxmox.nix's
  own plain device path). wifiPassword removed.
- modules/networking/wifi.nix: reworked to pull the wifi password from a
  new sops secret (secrets/gui.yaml, wifi-password) instead of a plaintext
  variable -- NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"`
  literally (nixpkgs' own documented pattern for this) and envsubst-expands
  it from a sops-rendered EnvironmentFile at activation, so the real value
  never touches the Nix store, only /run.
- .sops.yaml: new secrets/gui\.yaml rule, admin + the currently-registered
  lxc-gui recipient (the only gui variant with a provisioned host key so
  far -- whichever variant is actually deployed next still needs
  scripts/secrets/sync-host-keys.sh run for its own recipient).
- README.md/CLAUDE.md: documented the new platform/target and its module
  layout, per this repo's own drift-prevention note.

Verified end-to-end: nix eval of every existing target (nothing broke),
a temporary real nixosSystem build against the actual disko.nixosModules.disko
confirming the generated zpool create has no mirror/raidz keyword (genuine
stripe), and a temporary test SSID confirming the sops secret/template/
ensureProfiles chain renders correctly before reverting to blank/real values.
Full scripts/codex-maintenance.sh (secret-grep, fmt, statix, full-fallback
eval of every host/package) passes clean.

modules/hardware-configuration/baremetal.nix

@@ -0,0 +1,23 @@
+# Adapted from the output of `nixos-generate-config`, run from a live GUI
+# ISO boot on the actual gui-host hardware (AMD CPU). fileSystems and
+# swapDevices are deliberately omitted -- the live ISO had no formatted
+# disks to detect, and disko (modules/disko/baremetal.nix) generates both
+# from the declarative zpool layout anyway.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot = {
+    initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

modules/networking/wifi.nix

@@ -1,14 +1,31 @@
-{ lib, vars, ... }:
+{ config, lib, vars, ... }:
 
 {
-  # Prestages a NetworkManager connection profile for vars.wifiSsid/
-  # wifiPassword so the host associates on first boot with no manual
-  # nmtui/nmcli step. Guarded on a non-empty SSID so leaving the
-  # placeholders blank in variables.nix is a no-op rather than an empty,
-  # broken profile — fill both in once the bare-metal hardware profile is
-  # wired up.
-  networking.networkmanager.ensureProfiles.profiles = lib.mkIf (vars.wifiSsid != "") {
-    ${vars.wifiSsid} = {
+  # Prestages a NetworkManager connection profile for vars.wifiSsid so the
+  # host associates on first boot with no manual nmtui/nmcli step. Guarded
+  # on a non-empty SSID so leaving the placeholder blank in variables.nix
+  # is a no-op rather than an empty, broken profile — fill it in once the
+  # network is known.
+  #
+  # The password itself lives in secrets/gui.yaml, not variables.nix --
+  # NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"`
+  # literally into the store (see nixpkgs' own ensureProfiles example,
+  # which does the same for exactly this reason) and its systemd service
+  # envsubst-expands it from environmentFiles at activation time, so the
+  # real value only ever touches /run (root-only, UMask 0177), never the
+  # Nix store.
+  sops.secrets."wifi-password" = lib.mkIf (vars.wifiSsid != "") {
+    sopsFile = ../../secrets/gui.yaml;
+  };
+
+  sops.templates."wifi-password.env" = lib.mkIf (vars.wifiSsid != "") {
+    content = "WIFI_PASSWORD=${config.sops.placeholder."wifi-password"}";
+  };
+
+  networking.networkmanager.ensureProfiles = lib.mkIf (vars.wifiSsid != "") {
+    environmentFiles = [ config.sops.templates."wifi-password.env".path ];
+
+    profiles.${vars.wifiSsid} = {
       connection = {
         id = vars.wifiSsid;
         type = "wifi";
@@ -19,7 +36,7 @@
       };
       wifi-security = {
         key-mgmt = "wpa-psk";
-        psk = vars.wifiPassword;
+        psk = "$WIFI_PASSWORD";
       };
     };
   };

modules/platforms/baremetal.nix

@@ -0,0 +1,28 @@
+{ ... }:
+
+{
+  imports = [
+    ../hardware-configuration/baremetal.nix
+    ../boot/efi.nix
+    ../disko/baremetal.nix
+    ../services/zfs/enable-service.nix
+  ];
+
+  # Needed for real wifi/bluetooth/GPU firmware blobs and CPU microcode
+  # updates (hardware-configuration/baremetal.nix's amd.updateMicrocode
+  # keys off this) -- irrelevant on the linode/proxmox/lxc platforms,
+  # which are all VMs with no real hardware to load firmware for.
+  hardware.enableRedistributableFirmware = true;
+
+  # AMD GPU: the amdgpu kernel driver autoloads from the PCI ID with no
+  # extra boot.kernelModules entry needed; this is the userspace half --
+  # the dedicated Xorg driver (not just the generic modesetting fallback)
+  # plus Mesa OpenGL/Vulkan (amdgpu/RADV), same firmware blobs as above.
+  # 32-bit support is for compatibility with 32-bit apps/games.
+  services.xserver.videoDrivers = [ "amdgpu" ];
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+}