feat(core): initialize NaxOS declarative NixOS distribution, modules, and ISO installer

modules/core/users.nix

@@ -0,0 +1,80 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.naxos.users;
+in {
+  options.services.naxos.users = {
+    enable = mkEnableOption "NaxOS Declarative User Management";
+
+    adminUser = mkOption {
+      type = types.str;
+      default = "admin";
+      description = "Primary administrator account name.";
+    };
+
+    adminSshKeys = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "Public SSH keys for the administrator.";
+    };
+
+    users = mkOption {
+      type = types.attrsOf (types.submodule {
+        options = {
+          description = mkOption {
+            type = types.str;
+            default = "";
+            description = "User full name or comment.";
+          };
+          isAdmin = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether the user has sudo/wheel privileges.";
+          };
+          sshKeys = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            description = "Public SSH authorized keys.";
+          };
+          extraGroups = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            description = "Additional Linux groups.";
+          };
+          smbAccess = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Whether the user can access SMB shares.";
+          };
+        };
+      });
+      default = {};
+      description = "Appliance user accounts.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.mutableUsers = true;
+
+    # Admin user creation
+    users.users.${cfg.adminUser} = {
+      isNormalUser = true;
+      description = "NaxOS Primary Administrator";
+      extraGroups = [ "wheel" "docker" "video" "render" "users" ];
+      openssh.authorizedKeys.keys = cfg.adminSshKeys;
+      shell = pkgs.bashInteractive;
+    };
+
+    # Additional users
+    users.users = mapAttrs (name: ucfg: {
+      isNormalUser = true;
+      description = ucfg.description;
+      extraGroups = (if ucfg.isAdmin then [ "wheel" ] else []) ++ ucfg.extraGroups ++ [ "users" ];
+      openssh.authorizedKeys.keys = ucfg.sshKeys;
+    }) cfg.users;
+
+    security.sudo.wheelNeedsPassword = false;
+  };
+}