feat: add recovery-safe physical host and VPN tools

Keep kbot, Plasma/SDDM, NetworkManager, systemd-boot and the installed storage while adding dev/Hyprland as a separate physical host target. Keep EC2 integration and its updater isolated.

Include WireGuard/OpenVPN clients, NetworkManager OpenVPN integration and network diagnostics; add recovery checks and activation instructions.

common.nix

@@ -0,0 +1,29 @@
+# Shared dev environment; boot, storage, recovery users and updates are host-specific.
+{ config, inputs, ... }:
+{
+  imports = [
+    ./users.nix
+    ./tools.nix
+    ./network.nix
+    ./desktop.nix
+    ./apps.nix
+    ./neovim.nix
+  ];
+
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  nix = {
+    channel.enable = false;
+    # Keep non-login environments on the same pin when NIX_PATH is unset.
+    settings.nix-path = config.nix.nixPath;
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+  };
+
+  system.configurationRevision = inputs.self.rev or inputs.self.dirtyRev or null;
+
+  # Initial data/default compatibility, not the desired package release.
+  system.stateVersion = "26.05";
+}