Add SD image pipeline, documentation overhaul, and fix module issues

- Add automatic SD image builds for Raspberry Pi via Forgejo Actions
- Enable binfmt emulation on cryodev-main for aarch64 cross-builds
- Add sd-image.nix module to cryodev-pi configuration
- Create comprehensive docs/ structure with installation guides
- Split installation docs into: first-install (server), reinstall, new-client (Pi)
- Add lib/utils.nix and apps/rebuild from synix
- Fix headplane module for new upstream API (tale/headplane)
- Fix various module issues (mailserver stateVersion, option conflicts)
- Add placeholder secrets.yaml files for both hosts
- Remove old INSTRUCTIONS.md (content moved to docs/)

hosts/cryodev-main/secrets.yaml

@@ -0,0 +1,18 @@
+# SOPS encrypted secrets for cryodev-main
+# This file should be encrypted with sops before committing
+# See INSTRUCTIONS.md for setup instructions
+
+# Placeholder - replace with actual encrypted secrets
+forgejo-runner:
+    token: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]
+tailscale:
+    auth-key: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]
+headplane:
+    cookie_secret: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]
+    agent_pre_authkey: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]
+mailserver:
+    accounts:
+        forgejo: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]
+        admin: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]
+forgejo:
+    mail-pw: ENC[AES256_GCM,data:placeholder,tag:placeholder,type:str]