feat(hosts): add the Raspberry Pi Zero 2 W Psion sidecar

A headless aarch64 companion for a Psion 5MX: PPP over RS232 with NAT out to
wifi and a telnet login, plus a cleartext POP3/SMTP proxy for the Psion's mail
client.

- hosts/PiZero2W/: host config, serial-ppp.nix, email-proxy.nix, an SD-image
  variant, and a hardware-configuration.nix placeholder.
- Host table entry on nixos-hardware's raspberry-pi-3 profile; the Zero 2 W is
  the Pi 3's BCM2837 SoC. nixpkgs' linuxPackages_rpi02w is deprecated and warns
  that the linux-rpi series is being removed in favour of nixos-hardware.
- The host owns its firmware partition (hardware.raspberry-pi.firmware), which
  is what puts the disable-bt and uart0/ctsrts overlays in config.txt so
  /dev/ttyAMA0 is the RS232 header rather than Bluetooth. uboot.enable keeps the
  U-Boot -> extlinux boot path the rewritten config.txt would otherwise lose.
- packages.aarch64-linux.zero2w-sd-image: the host's own configuration as an
  installable card. The board has no Ethernet and no free serial port, so a
  generic image would leave no way in.
- The mail proxy comes from the legacy-email-proxy flake, which provides the
  package and the NixOS module; nothing about it is vendored here.
- docs/hosts/pizero2w.md, plus README host table and shared-layer notes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hosts/PiZero2W/sd-image.nix

@@ -0,0 +1,44 @@
+# SD-card image of this host, used exactly once: to bring the board up.
+#
+# Deliberately NOT imported by ./configuration.nix. The flake extends the host
+# with it (see packages.aarch64-linux.zero2w-sd-image in ../../flake.nix), so
+# the card carries the host's own kernel, config.txt and SSH keys rather than a
+# generic installer that then has to be reconfigured over a console this host
+# does not have -- pppd owns the serial port (./serial-ppp.nix).
+#
+# It does not carry the runtime secrets. Seed those into the card's root
+# partition before first boot; see ../../docs/hosts/pizero2w.md.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [ "${modulesPath}/installer/sd-card/sd-image.nix" ];
+
+  # sd-image.nix pulls in profiles/all-hardware.nix, which is every driver and
+  # firmware blob NixOS knows about. The raspberry-pi-3 profile already carries
+  # what this board has, and the card is small.
+  hardware.enableAllHardware = lib.mkForce false;
+
+  image.baseName = "nixos-zero2w";
+
+  sdImage = {
+    # Compressing costs a long single-threaded pass and buys nothing: the image
+    # is written straight to a card with dd.
+    compressImage = false;
+
+    # The default 30 MiB does not hold the vendor GPU firmware, U-Boot and the
+    # BCM2837 device trees and overlays that nixos-hardware installs here.
+    firmwareSize = 128;
+
+    # The firmware partition is populated by nixos-hardware's firmware module
+    # (it takes over sdImage.populateFirmwareCommands); the root side is the
+    # stock extlinux install, which no longer arrives with it.
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}