feat: extract reusable nix platform modules

[jorisjonkers-dev-agents]

Summary

• add reusable AMD/NVIDIA GPU roles and parameterized Tailscale, media storage, Samba, Ollama ROCm, and btrfs snapshot service modules
• export the new modules from the flake and fleet helper role map
• document the public API with sanitized examples and add a gitleaks CI gate to Pipeline Complete

Validation

• gitleaks detect --no-git --redact --source . --exit-code 1
• gitleaks protect --staged --redact --exit-code 1
• git diff --check
• parsed .github/workflows/*.yml with js-yaml

nix flake check --print-build-logs could not run locally because this container has no nix binary or /nix store; GitHub CI runs the Nix gate.