feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/base/etc/ssh/sshd_config.d/10-arcline-hardening.conf

@@ -0,0 +1,24 @@
+# Arcline OS — ssh hardening
+# Secure by default: key-based auth only, root login via key only.
+# To allow password auth, comment the PasswordAuthentication line — you opt
+# in to exposure, never out.
+#
+# Matches Debian's drop-in semantics (Read drop-ins from sshd_config.d).
+
+# authentication
+PermitRootLogin prohibit-password
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitEmptyPasswords no
+MaxAuthTries 3
+LoginGraceTime 30
+
+# session hardening
+X11Forwarding no
+AllowTcpForwarding yes
+AllowAgentForwarding yes
+ClientAliveInterval 300
+ClientAliveCountMax 2
+TCPKeepAlive no
+UseDNS no