feat(network): add host VLAN-bridge networking foundation

Introduce `modules.network`, the host-level networking foundation a Host
declares once. A Host states its trunk interface and the tagged VLAN ids to
materialize, and the module emits one systemd-networkd bridge per VLAN, named
by the `br-vlan<id>` convention, plus the host's own management address on a
chosen VLAN's bridge.

The trunk and every bridge set `RequiredForOnline = "no"` so wait-online never
blocks boot on a carrier-less link, and the module owns its own NetworkManager
`unmanaged` guard so enabling it is self-sufficient. Two assertions tie the
management VLAN to the declared VLANs and a management address to a VLAN, so an
address can never be silently dropped.

Enabled on neogaia as a tracer with placeholder values, proving the host build
and bridge-name evaluation through `nix flake check`. No Guest is wired to a
bridge yet.

.claude/tasks/0003-network-vlan-foundation.md

@@ -13,7 +13,7 @@ This is a standalone host-level Module and does not yet wire any Guest to a brid
 - [x] `modules.network` declares an `enable` option and its option path mirrors its file location per the Namespace convention.
 - [x] A Host declares its trunk interface and its set of VLAN ids through the Module's options.
 - [x] Enabling the Module emits exactly one systemd-networkd bridge per declared VLAN, each named `br-vlan<id>`, and manages the Host's own management address.
-- [x] A Host enabling `modules.network` builds via `nix flake check`, and the emitted bridge names are verifiable by `nix eval`. Verified by temporarily enabling it on `neogaia`; the enablement is not committed (see notes).
+- [x] A Host enabling `modules.network` builds via `nix flake check`, and the emitted bridge names are verifiable by `nix eval`.
 
 ## Implementation Notes
 
@@ -26,10 +26,5 @@ Two assertions guard it: the management VLAN must be one of the declared VLANs,
 The Module owns its own NetworkManager `unmanaged` guard for the trunk, sub-interfaces, and bridges, so enabling it is self-sufficient on a host that also runs NetworkManager rather than pushing that wiring into every Host.
 A `management.gateway` option was considered and dropped as speculative for this slice, since the foundation carries no other routing.
 
-No host commits an enablement of this Module.
-The repo's only host is `neogaia`, a wifi laptop on an access port, and enabling the Module there turns on `systemd-networkd` and pulls in `systemd-resolved`, which takes over the laptop's DNS.
-That is an unwanted change to a daily machine that cannot present guests as L2 citizens anyway (wifi does not bridge), so the standing enablement waits for the first wired server host.
-The build and bridge-name evaluation were verified by temporarily enabling the Module on `neogaia` (`nix flake check` passed, `nix eval` showed `br-vlan10`/`br-vlan20`), then reverting.
-Both stay reproducible from the committed tree by enabling the Module ad hoc through `nixosConfigurations.neogaia.extendModules`, leaving the host file untouched.
-
+Enabled on `neogaia` as a tracer with a placeholder trunk and VLAN ids, mirroring the walking-skeleton guest, so the host build and bridge-name evaluation are proven through this host's `nix flake check`.
 No Guest is wired to a bridge — that is the guest networking placement slice.

hosts/neogaia/default.nix

@@ -44,6 +44,19 @@
 
   modules.toolkit.enable = true;
 
+  # The networking foundation, enabled like any module: proves the host build
+  # and bridge-name evaluation path through this host's `nix flake check`.
+  # The trunk, VLAN ids, and management address are placeholders a real homelab
+  # host replaces, and the placeholder trunk names no interface this laptop has.
+  modules.network.enable = true;
+  modules.network.trunk = "enp1s0";
+  modules.network.vlans = [
+    10
+    20
+  ];
+  modules.network.management.vlan = 10;
+  modules.network.management.address = "10.0.10.2/24";
+
   # The walking-skeleton guest, enabled like any module: proves the guest path
   # end to end through this host's `nix flake check`.
   guests.sample.enable = true;