feat: bidirectional remote builders — server <> uConsole

Add reusable remote-builder NixOS module and builder system user.

Server (lazyworkhorse): dispatches aarch64-linux builds to uConsole
uConsole: dispatches x86_64-linux builds to server

The builder user uses the same SSH keypair on both hosts for
symmetric remote building. Generate the key with:
  ssh-keygen -t ed25519 -f /etc/ssh/builder_key -N ""
Add the public key to lib/keys.nix (replace PLACEHOLDER).

flake.nix

@@ -102,7 +102,9 @@
               }
               nixos-raspberrypi.nixosModules.raspberry-pi-5.base
               nixos-uconsole.nixosModules.uconsole-cm5
+              ./modules/nixos/services/remote-builder.nix
               ./hosts/uConsole/configuration.nix
+              ./users/builder.nix
               ./hosts/uConsole/hardware-configuration.nix
             ];
           };

hosts/uConsole/configuration.nix

@@ -168,4 +168,23 @@
   # Reticulum uses its own encryption and doesn't need open ports
   # for basic mesh operations (peer-to-peer discovery).
   # For TCP interfaces, open additional ports as needed.
+
+  # ============================================================
+  # Remote builder — dispatches x86_64-linux builds to server
+  # ============================================================
+  services.remoteBuilder = {
+    enable = true;
+    machines = [
+      {
+        hostName = "lazyworkhorse.net";
+        port = 2424;
+        sshUser = "builder";
+        sshKey = "/etc/ssh/builder_key";
+        systems = [ "x86_64-linux" ];
+        maxJobs = 36;
+        supportedFeatures = [ "benchmark" "big-parallel" "nixos-test" ];
+      }
+    ];
+  };
+
 }