feat: refactor infra to cp/wk kubeadm topology

Provision 3 thin control planes and 3 workers with role-specific sizing and VMID ranges (701/711), generate per-node cloud-init snippets with SSH key injection, and add NixOS kubeadm host/module scaffolding for cp-1..3 and wk-1..3.

nixos/kubeadm/flake.nix

@@ -0,0 +1,26 @@
+{
+  description = "NixOS kubeadm cluster configs";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+  };
+
+  outputs = { nixpkgs, ... }:
+    let
+      system = "x86_64-linux";
+      mkHost = hostModules:
+        nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = hostModules;
+        };
+    in {
+      nixosConfigurations = {
+        cp-1 = mkHost [ ./hosts/cp-1.nix ];
+        cp-2 = mkHost [ ./hosts/cp-2.nix ];
+        cp-3 = mkHost [ ./hosts/cp-3.nix ];
+        wk-1 = mkHost [ ./hosts/wk-1.nix ];
+        wk-2 = mkHost [ ./hosts/wk-2.nix ];
+        wk-3 = mkHost [ ./hosts/wk-3.nix ];
+      };
+    };
+}