feat(hosts): add the Raspberry Pi Zero 2 W Psion sidecar

A headless aarch64 companion for a Psion 5MX: PPP over RS232 with NAT out to
wifi and a telnet login, plus a cleartext POP3/SMTP proxy for the Psion's mail
client.

- hosts/PiZero2W/: host config, serial-ppp.nix, email-proxy.nix, an SD-image
  variant, and a hardware-configuration.nix placeholder.
- Host table entry on nixos-hardware's raspberry-pi-3 profile; the Zero 2 W is
  the Pi 3's BCM2837 SoC. nixpkgs' linuxPackages_rpi02w is deprecated and warns
  that the linux-rpi series is being removed in favour of nixos-hardware.
- The host owns its firmware partition (hardware.raspberry-pi.firmware), which
  is what puts the disable-bt and uart0/ctsrts overlays in config.txt so
  /dev/ttyAMA0 is the RS232 header rather than Bluetooth. uboot.enable keeps the
  U-Boot -> extlinux boot path the rewritten config.txt would otherwise lose.
- packages.aarch64-linux.zero2w-sd-image: the host's own configuration as an
  installable card. The board has no Ethernet and no free serial port, so a
  generic image would leave no way in.
- The mail proxy comes from the legacy-email-proxy flake, which provides the
  package and the NixOS module; nothing about it is vendored here.
- docs/hosts/pizero2w.md, plus README host table and shared-layer notes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

flake.nix

@@ -67,6 +67,13 @@
       url = "github:jonmosco/kube-tmux";
       flake = false;
     };
+    # legacy-email-proxy: cleartext POP3/SMTP front end for the Psion's mail
+    # client, proxied to authenticated IMAPS/SMTPS. Ships its own package and
+    # NixOS module; the Pi Zero 2 W host just enables the service.
+    legacy-email-proxy = {
+      url = "git+https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -327,6 +334,26 @@
               ./users/lyrathorpe/home.nix
             ];
           };
+
+          lyrathorpe-zero2w = {
+            system = "aarch64-linux";
+            portable = false;
+            # Headless "Psion sidecar": PPP over RS232 plus a legacy mail proxy
+            # (hosts/PiZero2W/). No sway.nix; the raspberry-pi-3 profile carries
+            # the kernel/firmware/device tree (the Zero 2 W is the Pi 3's
+            # BCM2837 SoC) and ssh.nix adds key-only sshd. This board has 512 MB
+            # of RAM and never builds its own system -- see
+            # docs/hosts/pizero2w.md.
+            modules = [
+              ./hosts/PiZero2W/configuration.nix
+              inputs.nixos-hardware.nixosModules.raspberry-pi-3
+              ./modules/ssh.nix
+            ];
+            users.lyrathorpe.homeModules = [
+              ./home
+              ./users/lyrathorpe/home.nix
+            ];
+          };
         };
 
         # Darwin host table — macOS machines built via mkDarwinHost. The shared
@@ -365,8 +392,24 @@
         # nixpkgs instance for that system. Outputs here become per-system
         # attrsets automatically (e.g. devShells.<system>.default).
         perSystem =
-          { config, pkgs, ... }:
           {
+            config,
+            pkgs,
+            system,
+            ...
+          }:
+          {
+            # One-shot SD card for bringing the Pi Zero 2 W up: that host's own
+            # configuration plus the sd-image module, so the first boot is
+            # already the real system. aarch64-linux only -- building it needs
+            # an aarch64 Linux builder. See docs/hosts/pizero2w.md.
+            packages = lib.optionalAttrs (system == "aarch64-linux") {
+              zero2w-sd-image =
+                ((mkHost hosts.lyrathorpe-zero2w).extendModules {
+                  modules = [ ./hosts/PiZero2W/sd-image.nix ];
+                }).config.system.build.sdImage;
+            };
+
             # treefmt drives `nix fmt` and the formatting check below. nixfmt
             # stays the .nix formatter (the tree is already nixfmt-formatted);
             # shfmt covers shell and prettier covers markdown/yaml/json.