fix zaatar build: move printer groups to configs/default.nix

printing.nix can't conditionally set users.users.me.extraGroups —
any mention of users.users.me in the module system creates the user
entry and triggers the isNormalUser/isSystemUser assertion on machines
without a 'me' user (like zaatar).

Move lp/scanner groups to configs/default.nix where users.users.me is
defined. On zaatar, root gets lp/scanner groups directly.

systems/zaatar/configuration.nix

@@ -77,6 +77,8 @@
       pkgs.python3 # for sshuttle
     ];
 
+  users.users.root.extraGroups = [ "lp" "scanner" ];
+
   networking = {
     hostName = "zaatar";
     wireless.interfaces = [ "wlp2s0" ];