fix(power): pin the tuned profile per host, cap the VM hosts (#458)

Assisted-by: DeepSeek Harness (deepseek-flash)

lib/genVmHostModule.nix

@@ -10,6 +10,14 @@ let
   ipv4WithMask = "${ipv4}/24";
 in
 {
+  # Physical machines only: these three always-on mini PCs hold their CPU at
+  # TuneD's power-saving profile (EPP biased to power, cpufreq boost off). A
+  # MicroVM guest has no EPP or boost of its own, so it never imports this module.
+  imports = [ ../modules/nixos/power.nix ];
+  services.tuned.recommend = {
+    powersave = { };
+  };
+
   # supported file systems, so we can mount any removable disks with these filesystems
   boot.supportedFilesystems = [
     "ext4"