feat: Complete sleeper-service deployment with ZFS and network fixes

✅ Major deployment milestone achieved:

**sleeper-service Configuration:**
- Successfully deployed flake-based NixOS on Intel Xeon file server
- Resolved ZFS mounting conflicts causing boot failures
- Implemented ZFS native mounting (/mnt/storage, /mnt/storage/media)
- Added Pi-hole DNS integration (10.0.0.14) for package resolution
- Configured systemd-networkd with static IP (10.0.0.8)
- System boots cleanly in ~1 minute with ZFS auto-mounting

**Infrastructure Updates:**
- SSH key management deployed and operational
- Network configuration with multi-tier DNS (Pi-hole, router, Google)
- NFS server configuration for network storage
- Data preservation verified: 903GB ZFS pool intact

**Technical Solutions:**
- Added nomodeset kernel parameter for graphics compatibility
- Disabled NVIDIA drivers for headless server operation
- Removed conflicting ZFS entries from hardware-configuration.nix
- Established remote deployment workflow via rsync + SSH

**Documentation:**
- Updated plan.md with deployment status and lessons learned
- Added deployment commands and troubleshooting notes
- Documented ZFS native mounting migration process

**Data Verified:**
- Films: 184GB, Series: 612GB, Audiobooks: 94GB, Music: 9.1GB, Books: 3.5GB
- Storage pool: 903GB used, 896GB available
- All media accessible via proper ZFS auto-mounting

This represents the first successful multi-machine flake deployment in the home lab infrastructure migration.

machines/grey-area/nixos/tailscale.nix

@@ -0,0 +1,18 @@
+{config, pkgs, ... }:
+  {
+    environment.systemPackages = with pkgs; [
+      tailscale
+    ];
+
+    services.tailscale.enable = true;
+    networking.firewall = {
+      # trace: warning: Strict reverse path filtering breaks Tailscale exit node
+      # use and some subnet routing setups. Consider setting
+      # `networking.firewall.checkReversePath` = 'loose'
+      checkReversePath = "loose";
+      trustedInterfaces = [ "tailscale0" ];
+    };
+  }
+#+end80808080 * nginx
+
+#+begin_src nix