printing.nix can't conditionally set users.users.me.extraGroups —
any mention of users.users.me in the module system creates the user
entry and triggers the isNormalUser/isSystemUser assertion on machines
without a 'me' user (like zaatar).
Move lp/scanner groups to configs/default.nix where users.users.me is
defined. On zaatar, root gets lp/scanner groups directly.
feat(zaatar): convert to flake
feat(tahina, tabula): convert to flake
feat(makanek): convert to flake
feat(manakish, zaatar): convert to flake
feat(ci): build flake systems
fix: ci build
feat: secrets via submodule
foo
foo
foo
