feat(hosts): add the Raspberry Pi Zero 2 W Psion sidecar

A headless aarch64 companion for a Psion 5MX: PPP over RS232 with NAT out to
wifi and a telnet login, plus a cleartext POP3/SMTP proxy for the Psion's mail
client.

- hosts/PiZero2W/: host config, serial-ppp.nix, email-proxy.nix, an SD-image
  variant, and a hardware-configuration.nix placeholder.
- Host table entry on nixos-hardware's raspberry-pi-3 profile; the Zero 2 W is
  the Pi 3's BCM2837 SoC. nixpkgs' linuxPackages_rpi02w is deprecated and warns
  that the linux-rpi series is being removed in favour of nixos-hardware.
- The host owns its firmware partition (hardware.raspberry-pi.firmware), which
  is what puts the disable-bt and uart0/ctsrts overlays in config.txt so
  /dev/ttyAMA0 is the RS232 header rather than Bluetooth. uboot.enable keeps the
  U-Boot -> extlinux boot path the rewritten config.txt would otherwise lose.
- packages.aarch64-linux.zero2w-sd-image: the host's own configuration as an
  installable card. The board has no Ethernet and no free serial port, so a
  generic image would leave no way in.
- The mail proxy comes from the legacy-email-proxy flake, which provides the
  package and the NixOS module; nothing about it is vendored here.
- docs/hosts/pizero2w.md, plus README host table and shared-layer notes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hosts/PiZero2W/email-proxy.nix

@@ -0,0 +1,25 @@
+# legacy-email-proxy: a cleartext POP3 (110) and SMTP (25) front end for the
+# Psion's built-in mail client, forwarded to authenticated IMAPS/SMTPS.
+#
+# The package, the systemd unit and its hardening all live upstream
+# (https://code.emmathe.dev/lyrathorpe/legacy-email-proxy); this host only
+# enables the service and points it at the credentials.
+{ inputs, ... }:
+{
+  imports = [ inputs.legacy-email-proxy.nixosModules.default ];
+
+  services.legacy-email-proxy = {
+    enable = true;
+
+    # The listeners are unauthenticated and unencrypted by design, so the
+    # firewall is what confines them: ppp0 is trusted, wlan0 is not, and 110/25
+    # are never opened there (./serial-ppp.nix). They stay on the default
+    # 0.0.0.0 rather than the PPP address because 10.0.0.1 exists only while
+    # the Psion is plugged in, and a bind-time dependency on a serial cable is
+    # a restart loop waiting to happen.
+
+    # Backend hostnames and credentials. Kept out of the Nix store: created on
+    # the device, root-owned 0600. See ../../docs/hosts/pizero2w.md.
+    environmentFile = "/var/lib/legacy-email-proxy/backend.env";
+  };
+}