feat(neogaia): enable networking and set the base locale

Turn the booted laptop into a usable, remotely reachable console: enable
NetworkManager so wifi can be joined from the console and an SSH daemon so
the rest of the setup can be driven over the network. Set the base locale to
timezone America/New_York, locale en_GB.UTF-8, and console keymap us.

These live inline in the neogaia Host rather than behind enable Modules,
matching the single-Host MVI precedent; a shared locale/networking Module can
be extracted once a second Host needs the same settings. SSH keeps default
password auth on, as first-boot access relies on the hand-set bootstrap
password until key/sops-based auth lands post-install.

.claude/tasks/0004-networking-and-base-system.md

@@ -0,0 +1,28 @@
+---
+spec: laptop-mvi
+blocked-by: 0001-skeleton-and-building-host
+---
+
+## What to build
+
+Make the booted laptop a usable console I can log into and reach remotely: NetworkManager for joining wifi, an SSH daemon for driving the rest of the setup over the network, and the base locale settings.
+
+Set timezone `America/New_York`, locale `en_GB.UTF-8`, and console keymap `us`.
+
+## Acceptance criteria
+
+- [x] NetworkManager is enabled so wifi can be joined from the console.
+- [x] An SSH daemon is enabled so the machine can be driven remotely.
+- [x] Timezone is `America/New_York`, locale is `en_GB.UTF-8`, console keymap is `us`.
+- [x] The `neogaia` toplevel still builds with all of the above.
+
+## Implementation Notes
+
+- **Placement in the Host, not a Module.** NetworkManager, the SSH daemon, and the locale/timezone/keymap settings all live directly in `hosts/neogaia/default.nix`, alongside the kernel/hardware/zram lines from task 0003.
+  This follows the precedent set in that task, where a speculative enable-gated Module was dropped in review in favour of inlining for the single-Host MVI.
+  A shared locale Module or a networking Module can be extracted later when a second Host actually needs the same settings; extracting now would be speculative generality.
+- **SSH left unhardened deliberately.** `services.openssh.enable = true` keeps NixOS's default password authentication on.
+  This is required by the install flow: first-boot access is over SSH with the hand-set bootstrap password, and no SSH keys or sops-derived age key exist until the install generates the Host's SSH host key.
+  Moving to key-only auth / `hashedPasswordFile` is the first post-boot follow-up per the spec's Secrets section, out of scope for the MVI.
+- **Locale/timezone mix is as specified.** `i18n.defaultLocale = "en_GB.UTF-8"` with `time.timeZone = "America/New_York"` and `console.keyMap = "us"` mixes region and locale; this matches the operator's stated preferences verbatim and is intentional.
+- **Verification.** Built the primary seam — `nix build .#checks.x86_64-linux.neogaia` (the Host toplevel) — to exit 0; the systemd units for `wpa_supplicant` (NetworkManager's backend) and openssh appear in the build. The five option values were also confirmed via `nix eval`.

hosts/neogaia/default.nix

@@ -28,4 +28,15 @@
 
   # Swap is RAM-backed zram rather than an on-disk partition.
   zramSwap.enable = true;
+
+  # NetworkManager drives the wifi so it can be joined from the console.
+  networking.networkmanager.enable = true;
+
+  # An SSH daemon so the rest of the setup can be driven over the network.
+  services.openssh.enable = true;
+
+  # Locale preferences for the base system.
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_GB.UTF-8";
+  console.keyMap = "us";
 }