add deploy/create/install apps, fix templates and docs

- Add apps: create (scaffold host from template), deploy (multi-host
  deployment with -n filter), install (NixOS installation from live ISO)
- Register all apps in flake.nix (create, deploy, install, rebuild)
- Add deploy.json config (cryodev-main, SSH port 2299)
- Fix generic-server template: was using Pi hardware/boot config,
  now correct x86_64 with systemd-boot, UEFI, ROOT/BOOT/SWAP labels
- Fix template networking.nix: use HOSTNAME placeholder instead of
  hardcoded cryodev-pi (both templates)
- Fix headplane upstream pnpm-deps hash mismatch via overlay
- Fix all docs: replace root@ with user@, --ssh-option with
  NIX_SSHOPTS, add deploy app references, update first-install guide
  to use create app and document service deactivation steps

AGENTS.md

@@ -43,13 +43,31 @@ nix develop
 ### Deployment
 
 ```bash
+# Deploy all hosts via deploy app (uses deploy.json)
+nix run .#deploy
+
 # Deploy to cryodev-main via deploy-rs
 nix run github:serokell/deploy-rs -- .#cryodev-main
 
 # Manual deployment via SSH
-nixos-rebuild switch --flake .#<hostname> \
-  --target-host <user>@<ip> --use-remote-sudo \
-  --ssh-option="-p 2299"
+NIX_SSHOPTS="-p 2299" nixos-rebuild switch --flake .#<hostname> \
+  --target-host <user>@<ip> --use-remote-sudo
+```
+
+### Apps
+
+```bash
+# Create a new host from template
+nix run .#create -- -t generic-server -n <hostname>
+
+# Install NixOS on a new machine (run from NixOS live ISO)
+nix run .#install -- -n <hostname> -r <REPO_URL>
+
+# Deploy to all configured hosts
+nix run .#deploy
+
+# Rebuild NixOS/Home Manager configuration
+nix run .#rebuild -- nixos
 ```
 
 ## Code Style & Conventions