feat(admin-plane): Headscale and a public Grafana on sensorica-holoport-01

[Soushi888]

SoushAI analysis. Drafted by Soushi's AI assistant, reviewed and posted by @Soushi888.

Closes part of #70: the module, its test and the fleet wiring. Deployment (DNS, router, switch, joins) is tracked on the issue.

What changes

• modules/admin-plane.nix, exported as nixosModules.admin-plane (not in default: one machine per fleet runs it, and it opens 80 and 443). Headscale on 127.0.0.1:8080 behind nginx with Let's Encrypt, a 403 "Private server" page on /, the machine's own Headscale name pinned to loopback, public DERP relays. grafana.domain puts Grafana on its own public name with its root URL rewritten and secure cookies. dnsDrift compares the site's public IPv4 with the public names every 15 minutes and publishes admin_plane_dns_matches_public_ip{name} through node_exporter, for registrars without a usable update API (GoDaddy under ten domains).
• vmTestAdminPlane in checks and in CI.
• sensorica-holoport-01 enables it: hs.sensorica.co, MagicDNS sensorica.internal, grafana.sensorica.co.
• docs/admin-plane.md: site prerequisites, deploy, join, revoke, a change of IP, moving the server to another site. docs/module-options.md regenerated.

Same shape as the athanor homelab's Headscale, with the DDNS client replaced by the drift check. acmeEmail is optional so no personal address lands in the repository.

Proof

$ nix build .#checks.x86_64-linux.vmTestAdminPlane -L
subtest: Headscale answers through nginx, the bare name is private   (11.20 s)
subtest: Plain HTTP only redirects                                   (0.09 s)
subtest: Grafana answers on its public name with its public root URL (26.47 s)
subtest: A client joins the tailnet through the proxy                (9.49 s)
subtest: The drift check is installed                                (0.10 s)
test script finished in 72.02s
exit 0

$ nix flake check --no-build --all-systems
exit 0

$ cd examples/sensorica-fleet && nix eval --override-input nixos-holochain path:../.. .#nixosConfigurations.sensorica-holoport-01.config.services.admin-plane ...
{"enable":true,"g":"grafana.sensorica.co","hs":"hs.sensorica.co","td":"/var/lib/prometheus-node-exporter-text-files"}

The first test run failed usefully: Headscale exits at startup when it cannot fetch Tailscale's DERP map, and the sandbox has no internet. The test serves its own relay, as nixpkgs' headscale test does; production keeps the public map, so the admin-plane machine needs internet at boot.