Add LAN-only music vhost and enable weekly autoUpgrade

- gateway: replace konnektor/api/auth/mailpit vhosts with
  music.home.lindenfelser.de -> 10.202.82.195:80, LAN-only (403 otherwise)
- common: enable system.autoUpgrade, pulling config from Gitea main and
  overriding nixpkgs to the nixos-25.11 tip for weekly package refresh;
  reboot allowed in a 04:00-06:00 window

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/common.nix

@@ -45,9 +45,24 @@
   # QEMU guest agent (for VM integration when running as guest)
   services.qemuGuest.enable = true;
 
-  # Automatic updates (security)
+  # Automatic updates — pull the committed config from Gitea and rebuild.
+  # Jeder Host baut sein eigenes Flake-Attribut (= networking.hostName).
   system.autoUpgrade = {
-    enable = false;  # Manual control via flake
-    allowReboot = false;
+    enable = true;
+    flake = "git+https://git.home.lindenfelser.de/danlin/infra-nix.git?ref=main#${config.networking.hostName}";
+    # nixpkgs beim Build auf die aktuelle Spitze von nixos-25.11 ziehen,
+    # statt den in main gepinnten flake.lock zu verwenden — so kommen
+    # wöchentlich frische Pakete ohne separaten Lock-Commit.
+    flags = [
+      "--override-input" "nixpkgs" "github:NixOS/nixpkgs/nixos-25.11"
+    ];
+    dates = "Sun 04:00";
+    randomizedDelaySec = "30min";
+    # Kernel/Init-Updates greifen nur nach Reboot — nachts im Fenster erlauben.
+    allowReboot = true;
+    rebootWindow = {
+      lower = "04:00";
+      upper = "06:00";
+    };
   };
 }