add deploy/create/install apps, fix templates and docs

- Add apps: create (scaffold host from template), deploy (multi-host
  deployment with -n filter), install (NixOS installation from live ISO)
- Register all apps in flake.nix (create, deploy, install, rebuild)
- Add deploy.json config (cryodev-main, SSH port 2299)
- Fix generic-server template: was using Pi hardware/boot config,
  now correct x86_64 with systemd-boot, UEFI, ROOT/BOOT/SWAP labels
- Fix template networking.nix: use HOSTNAME placeholder instead of
  hardcoded cryodev-pi (both templates)
- Fix headplane upstream pnpm-deps hash mismatch via overlay
- Fix all docs: replace root@ with user@, --ssh-option with
  NIX_SSHOPTS, add deploy app references, update first-install guide
  to use create app and document service deactivation steps

modules/nixos/headplane/default.nix

@@ -31,6 +31,14 @@ in
   config = mkIf cfg.enable {
     nixpkgs.overlays = [
       inputs.headplane.overlays.default
+      # Fix upstream pnpm-deps hash mismatch (https://github.com/tale/headplane)
+      (final: prev: {
+        headplane = prev.headplane.overrideAttrs (old: {
+          pnpmDeps = old.pnpmDeps.overrideAttrs {
+            outputHash = "sha256-lk/ezsrW6JHh5nXPSstqHUbaMTeOARBGZcBSoG1S5ns=";
+          };
+        });
+      })
     ];
 
     services.headplane = {