feat(hosts): make config multi-host and add vps host

Parametrize networking, users, and containers modules under
myNetworking/myUsers/myContainers so both hosts share the same logic
instead of duplicating it, and split desktop/server module imports
into modules/profiles/. Adds hosts/vps (not installed yet, hardware
config and bootloader device are placeholders) to run Traefik,
Headscale, Headplane, and Gitea via a combined Docker Compose stack.

Wires up agenix for secrets and migrates miku-homelab's WireGuard
private key off a plain filesystem path into an encrypted
secrets/miku-homelab-wg.age. The vps side of that tunnel still needs
its own key generated and encrypted after install.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/vps/default.nix

@@ -0,0 +1,73 @@
+{ config, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/profiles/server.nix
+  ];
+
+  # PLACEHOLDER: secrets/vps-wg.age does not exist yet. It has to be created
+  # (same way as secrets/miku-homelab-wg.age) once this host is installed and
+  # its own WireGuard private key has been generated.
+  age.secrets.vps-wg.file = ../../secrets/vps-wg.age;
+
+  myNetworking = {
+    hostName = "vps";
+    useNetworkManager = false;
+    staticIp = {
+      interface = "eth0";
+      address = "23.175.41.196";
+      prefixLength = 27;
+      gateway = "23.175.41.225";
+      nameservers = [ "1.1.1.1" "1.0.0.1" ];
+    };
+    extraTcpPorts = [ 80 443 ];
+    extraUdpPorts = [ 51822 ];
+    sshAllowUsers = [ "emmatherock" ];
+    wireguard = {
+      enable = true;
+      ips = [ "10.20.0.1/24" ];
+      privateKeyFile = config.age.secrets.vps-wg.path;
+      listenPort = 51822;
+      peers = [
+        {
+          publicKey = "bqxDHQNxOSFpTo3We9ujC2WljtaRBgiNEewW+Rlu10k=";
+          allowedIPs = [ "10.20.0.2/32" ];
+        }
+      ];
+    };
+  };
+
+  myUsers = {
+    admins.emmatherock = {
+      description = "EmmaTheRock";
+      extraGroups = [ "wheel" ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8vfwM5g9RJXqHtqTgNqsYg9SxSm+UMvFqTjBoAsLJ6 emmatherock@MAIN-PC"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIpTslcK0yQ6k+h8foNl17wVRyJUfEGzq7f1h3014WNB s21 plus"
+      ];
+    };
+  };
+
+  myContainers = {
+    enable = true;
+    composeStacks.core = {
+      path = "/opt/containers/core";
+      after = [ "network-online.target" ];
+    };
+  };
+
+  # PLACEHOLDER: adjust once the real VPS image/provider is known (BIOS vs
+  # UEFI, actual boot device). Assumes a generic BIOS-booted image for now.
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  time.timeZone = "UTC";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  system.stateVersion = "25.11";
+}