Enable incus on pureintent (#113)

* Enable incus on pureintent, rename lxd.nix, drop unused flake-parts

- Add incus module import to pureintent and bind the UI to its
  Tailscale IP (no firewall change needed since tailscale0 is trusted).
- Rename modules/nixos/linux/lxd.nix -> incus.nix since the module
  configures virtualisation.incus, and enable the bundled web UI.
- Drop the unused modules/flake-parts/incus-image helper; the
  `images:nixos/*` community images cover container/VM launches.

* Move incus module into a directory with a README

The troubleshooting notes used to live as comments in the module; they
belong in docs alongside a quick-start on launching containers/VMs and
configuring the UI listener.

* Expand incus README with VM gotchas

Document the sharp edges hit while bringing up a NixOS VM for the first
time: secureboot, memory/cpu/disk limits (with the error signatures
that point at each), configuring the guest (flakes, firewall), and a
three-step guide to exposing a service from inside.

configurations/nixos/pureintent/default.nix

@@ -13,8 +13,12 @@ in
     self.nixosModules.default
     ./configuration.nix
     (self + /modules/nixos/linux/beszel.nix)
+    (self + /modules/nixos/linux/incus)
   ];
 
+  # Expose the incus UI on the Tailscale interface only.
+  virtualisation.incus.preseed.config."core.https_address" = "100.122.32.106:8443";
+
   users.users.${flake.config.me.username}.linger = true;
   home-manager.sharedModules = [
     "${homeMod}/cli/ssh-agent-forwarding.nix"