mullvad: install the client on the Desktop Role only

The Mullvad VPN app and its daemon now ship with Desktop Only, as the stock
NixOS service with nothing configured on top of it: no local-network boot
service, no DNS or firewall edits of our own, no Hub tile, no Feature Manager
card, no toggles. The account, the relay, the kill switch and the app's other
switches belong to the app.

modules/mullvad.nix is the whole change to the system: a role gate around

  services.mullvad-vpn = {
    enable = true;      # daemon, pkgs.mullvad
    gui.enable = true;  # app, pkgs.mullvad-vpn
  };

Server + Desktop and Bitcoin Node are machines that serve; a VPN client with its
own routing and DNS policy is not something their services asked for, so only
roles.desktop builds it. Every other option stays at the distribution's default
(early boot blocking off, the mullvad-exclude wrapper on), and the only
consequences are the ones the NixOS module already defines — the tun module, and
systemd-resolved with NetworkManager pointed at it while the client is enabled.

The Hub and the desktop shell are untouched: no tile, no feature card, no
service description, no icon, no GNOME folder edit. An app that is simply
installed has no decision to put in front of the user, and no state to report.

README, SECURITY.md (what the app's own kill switch and DNS behaviour mean, so
the change in network behaviour is not a surprise), CHANGELOG, the custom.nix
template (the mkForce line that removes it) and the installer's Desktop card
document it as an app rather than a service.

tests/test_mullvad_desktop_only.py guards the gate and the restraint: the client
builds on Desktop and nowhere else, the module adds no services, no DNS or
firewall edits and no packages, the Hub and desktop shell never mention it, and
it ships no tile icon.

Checked by evaluating the real module against the revision flake.lock pins
(3d23ea05a8a3) with eval-config.nix, four cases: Desktop -> daemon and GUI on,
one unit (mullvad-daemon), mullvad + mullvad-vpn in systemPackages, every other
option at the distribution default; Bitcoin Node and Server + Desktop -> nothing
at all, not even the tun module or resolved; Desktop with
`services.mullvad-vpn.enable = lib.mkForce false;` -> no unit, no package.

SECURITY.md

@@ -92,6 +92,25 @@ the public internet. Key authentication only. Turn it off when you are done.
 Tor reduces network exposure for configured Bitcoin services. It is not a
 guarantee against every IP leak, application bug, or traffic-analysis attack.
 
+### Mullvad VPN (Desktop Only)
+
+The Mullvad VPN client — daemon and app — is installed on the Desktop Role and
+on no other role: Server + Desktop and Bitcoin Node keep the one network
+configuration their services need. `modules/mullvad.nix` is a role gate around
+the stock NixOS service, with nothing configured by this system on top of it.
+
+Two behaviours are the app's own, and worth knowing before you connect:
+
+- While the tunnel is up, Mullvad's kill switch blocks everything outside it,
+  the local network included, so Remote Desktop and other local devices stop
+  answering until you switch local network sharing on in the app.
+- Name resolution follows the tunnel for as long as the client is enabled: the
+  NixOS service turns on systemd-resolved and points NetworkManager at it.
+
+Neither is set or restricted here; both are visible and changeable in the app.
+The firewall rules, the Hub's exposure checks, the Bitcoin stack and Tor are
+untouched by this module.
+
 ### Restricted support access
 
 Tech Support runs over SSH, and the Hub refuses to start a session until SSH