feat: switch to incus-lts and fix lab-tool SSH syntax

- Use incus-lts (6.0.4) instead of latest incus to avoid cowsql build issues
- Re-enable incus on congenital-optimist with LTS version
- Restore incus-admin group membership for users
- Fix missing parentheses in lab-tool SSH module
- This provides stable containerization without build failures

modules/users/geir.nix

@@ -20,6 +20,7 @@ in {
       "wheel"
       "networkmanager"
       "libvirt"
+      "incus-admin"
       "podman"
       "audio"
       "video"

modules/users/sma.nix

@@ -21,6 +21,7 @@
       "wheel" # sudo access
       "networkmanager" # network management
       "libvirt" # virtualization management
+      "incus-admin" # container management
       "podman" # container runtime
       "docker" # docker compatibility (if needed)
       "media" # shared media access for NFS shares

modules/virtualization/incus.nix

@@ -1,37 +1,13 @@
 { config, pkgs, ... }:
-let
-  # Fix cowsql build issue with glibc 2.40
-  cowsql-fixed = pkgs.cowsql.overrideAttrs (oldAttrs: {
-    patches = (oldAttrs.patches or []) ++ [
-      (pkgs.writeText "cowsql-float-t-fix.patch" ''
-        --- a/src/lib/serialize.h
-        +++ b/src/lib/serialize.h
-        @@ -37,7 +37,9 @@
-         #define SERIALIZE_H_
-         
-         #include <uv.h>
-        +#ifndef _MATH_H
-         typedef double float_t;
-        +#endif
-         
-         struct serialize;
-      '')
-    ];
-  });
-  
-  incus-fixed = pkgs.incus.override {
-    cowsql = cowsql-fixed;
-  };
-in
 {
   virtualisation.incus = {
     enable = true;
     ui.enable = true;
-    package = incus-fixed;
+    package = pkgs.incus-lts;  # Use LTS version to avoid cowsql build issues
   };
 
   environment.systemPackages = [
-    incus-fixed
+    pkgs.incus-lts
     pkgs.lxc
   ];