libvirtd: KVM stack on FredOS-Gaming for Win11 guest

Adds libvirtd + virt-manager + OVMFFull (UEFI w/ Secure Boot) + swtpm
(software TPM 2.0) so a Windows 11 VM can install. Brings in virtio-win
ISO for guest drivers and virt-viewer for SPICE console. Adds fred to
the libvirtd group.

Reason: the Dungeon Runners client-side mod (DSOUND.dll inline-hook
trampolines + memory scanner) crashes wine with a guard-page violation
on init regardless of Proton vintage; the only realistic path for
character progression is to run the client on real Windows.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

common.nix

@@ -20,6 +20,7 @@
     ./services/server-permissions.nix
     ./services/game-servers.nix
     ./services/dr-server.nix
+    ./services/libvirtd.nix
     ./services/qbittorrent-nox.nix
     ./services/nginx.nix
     ./services/go2rtc.nix

services/libvirtd.nix

@@ -0,0 +1,29 @@
+{ config, pkgs, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Gaming") {
+    # KVM-based VM stack for running a Windows guest (mainly: the DR client
+    # mod is wine-incompatible and has to run on real Windows). virt-manager
+    # is the GUI; OVMFFull provides UEFI firmware with the Secure Boot bits
+    # Win11 needs, and swtpm gives the guest a software TPM 2.0 to satisfy
+    # Win11's install check.
+    virtualisation.libvirtd = {
+      enable = true;
+      qemu = {
+        swtpm.enable = true;
+        ovmf = {
+          enable = true;
+          packages = [ pkgs.OVMFFull.fd ];
+        };
+      };
+    };
+
+    programs.virt-manager.enable = true;
+
+    users.users.fred.extraGroups = [ "libvirtd" ];
+
+    environment.systemPackages = with pkgs; [
+      virt-viewer
+      virtio-win
+    ];
+  };
+}