roles: add role-based host composition in flake

- mkHost now takes a role list, roles resolve to ./roles/<name>.nix
- roles/core.nix = shared baseline (modules/)
- roles/k3s-server.nix = core + k3s (goyplex-vm)
- roles/hermes.nix = core + hermes (hermes-vm)
- host configuration.nix trimmed to hardware + boot + stateVersion
- optional hosts/<name>/custom.nix loads last for per-host overrides
- new hosts: one flake line + hosts/<name>/ dir

roles/core.nix

@@ -0,0 +1,6 @@
+{
+  # shared baseline: core system + home manager config
+  imports = [
+    ../modules
+  ];
+}

roles/hermes.nix

@@ -0,0 +1,7 @@
+{
+  # hermes agent host: core + hermes container + secrets
+  imports = [
+    ./core.nix
+    ../modules/hermes
+  ];
+}

roles/k3s-server.nix

@@ -0,0 +1,7 @@
+{
+  # k3s server node (goyplex-vm): k3s + manifests + firewall
+  imports = [
+    ./core.nix
+    ../modules/k3s/k3s.nix
+  ];
+}