feat: add recovery-safe physical host and VPN tools

Keep kbot, Plasma/SDDM, NetworkManager, systemd-boot and the installed storage while adding dev/Hyprland as a separate physical host target. Keep EC2 integration and its updater isolated.

Include WireGuard/OpenVPN clients, NetworkManager OpenVPN integration and network diagnostics; add recovery checks and activation instructions.

configuration.nix

@@ -1,37 +1,13 @@
-{
-  config,
-  inputs,
-  modulesPath,
-  ...
-}:
-
+# EC2 only. Physical machines must use the separate nixos host target.
+{ modulesPath, ... }:
 {
   imports = [
     # Keep the image's EC2 boot, storage, metadata, SSH and SSM integration.
     "${modulesPath}/virtualisation/amazon-image.nix"
-    ./users.nix
-    ./tools.nix
-    ./network.nix
-    ./desktop.nix
-    ./apps.nix
+    ./common.nix
     ./updates.nix
-    ./neovim.nix
   ];
 
-  nixpkgs.hostPlatform = "x86_64-linux";
-
-  nix = {
-    channel.enable = false;
-    # Keep non-login environments on the same pin when NIX_PATH is unset.
-    settings.nix-path = config.nix.nixPath;
-    settings.experimental-features = [
-      "nix-command"
-      "flakes"
-    ];
-  };
-
-  system.configurationRevision = inputs.self.rev or inputs.self.dirtyRev or null;
-
-  # Initial data/default compatibility, not the desired package release.
-  system.stateVersion = "26.05";
+  # Only the EC2 host keeps its dev-owned configuration checkout here.
+  systemd.tmpfiles.rules = [ "Z /etc/nixos - dev users -" ];
 }