add deploy/create/install apps, fix templates and docs

- Add apps: create (scaffold host from template), deploy (multi-host
  deployment with -n filter), install (NixOS installation from live ISO)
- Register all apps in flake.nix (create, deploy, install, rebuild)
- Add deploy.json config (cryodev-main, SSH port 2299)
- Fix generic-server template: was using Pi hardware/boot config,
  now correct x86_64 with systemd-boot, UEFI, ROOT/BOOT/SWAP labels
- Fix template networking.nix: use HOSTNAME placeholder instead of
  hardcoded cryodev-pi (both templates)
- Fix headplane upstream pnpm-deps hash mismatch via overlay
- Fix all docs: replace root@ with user@, --ssh-option with
  NIX_SSHOPTS, add deploy app references, update first-install guide
  to use create app and document service deactivation steps

apps/create/create.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+
+# Create a new host from a template
+
+FLAKE_DIR="."
+TEMPLATE=""
+HOSTNAME=""
+SYSTEM=""
+
+SEPARATOR="________________________________________"
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") -t TEMPLATE -n HOSTNAME [-s SYSTEM] [-f FLAKE_DIR]
+
+Options:
+  -t, --template TEMPLATE   Template to use (mandatory)
+  -n, --hostname HOSTNAME   Hostname for the new host (mandatory)
+  -s, --system SYSTEM       System architecture (default: derived from template)
+  -f, --flake FLAKE_DIR     Path to flake directory (default: .)
+  -h, --help                Show this help message
+
+Available templates:
+  generic-server    x86_64 server with SSH, Nginx, Headscale client
+  raspberry-pi      aarch64 Raspberry Pi 4 with Comin, Tailscale
+EOF
+}
+
+error() {
+  echo "Error: $1" >&2
+  exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -t|--template)  TEMPLATE="$2"; shift 2 ;;
+    -n|--hostname)  HOSTNAME="$2"; shift 2 ;;
+    -s|--system)    SYSTEM="$2"; shift 2 ;;
+    -f|--flake)     FLAKE_DIR="$2"; shift 2 ;;
+    -h|--help)      usage; exit 0 ;;
+    *)              error "Unknown option: $1" ;;
+  esac
+done
+
+# Validate
+[[ -z "$TEMPLATE" ]] && error "Template is required (-t)"
+[[ -z "$HOSTNAME" ]] && error "Hostname is required (-n)"
+
+TEMPLATE_DIR="$FLAKE_DIR/templates/$TEMPLATE"
+HOST_DIR="$FLAKE_DIR/hosts/$HOSTNAME"
+
+[[ ! -d "$TEMPLATE_DIR" ]] && error "Template '$TEMPLATE' not found in $TEMPLATE_DIR"
+[[ -d "$HOST_DIR" ]] && error "Host '$HOSTNAME' already exists in $HOST_DIR"
+
+# Derive system from template if not specified
+if [[ -z "$SYSTEM" ]]; then
+  case "$TEMPLATE" in
+    generic-server)  SYSTEM="x86_64-linux" ;;
+    raspberry-pi)    SYSTEM="aarch64-linux" ;;
+    *)               error "Cannot derive system for template '$TEMPLATE'. Use -s to specify." ;;
+  esac
+fi
+
+echo "$SEPARATOR"
+echo "Creating host '$HOSTNAME' from template '$TEMPLATE'"
+echo "  System:    $SYSTEM"
+echo "  Target:    $HOST_DIR"
+echo "$SEPARATOR"
+
+# Copy template
+cp -r "$TEMPLATE_DIR" "$HOST_DIR"
+
+# Remove template flake.nix (not needed in host dir)
+rm -f "$HOST_DIR/flake.nix"
+
+# Replace hostname in networking.nix
+sed -i "s/networking.hostName = \".*\"/networking.hostName = \"$HOSTNAME\"/" "$HOST_DIR/networking.nix"
+
+# Create empty secrets.yaml placeholder
+touch "$HOST_DIR/secrets.yaml"
+
+# Add to git
+git -C "$FLAKE_DIR" add "$HOST_DIR"
+
+echo "$SEPARATOR"
+echo "Host '$HOSTNAME' created successfully."
+echo ""
+echo "Next steps:"
+echo "  1. Add to flake.nix:"
+echo ""
+echo "     $HOSTNAME = mkNixosConfiguration \"$SYSTEM\" [ ./hosts/$HOSTNAME ];"
+echo ""
+echo "  2. Update hardware.nix and disks.sh for your hardware"
+echo "  3. Update .sops.yaml with creation rules for hosts/$HOSTNAME/secrets.yaml"
+echo "  4. Follow the first-install guide: docs/getting-started/first-install.md"

apps/create/default.nix

@@ -0,0 +1,20 @@
+{
+  writeShellApplication,
+  git,
+  gnused,
+  ...
+}:
+
+let
+  name = "create";
+  text = builtins.readFile ./${name}.sh;
+in
+writeShellApplication {
+  inherit name text;
+  meta.mainProgram = name;
+
+  runtimeInputs = [
+    git
+    gnused
+  ];
+}