security: make firewall secure-by-default, disable explicitly on servers

Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.

outputs/aarch64-linux/tests/security-firewall/expected.nix

@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = name == "ai-niri" || name == "shoukei-niri";
+}) nixosConfigurations

outputs/aarch64-linux/tests/security-firewall/expr.nix

@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = nixosConfigurations.${name}.config.networking.firewall.enable;
+}) nixosConfigurations

outputs/x86_64-linux/tests/security-firewall/expected.nix

@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = name == "ai-niri" || name == "shoukei-niri";
+}) nixosConfigurations

outputs/x86_64-linux/tests/security-firewall/expr.nix

@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = nixosConfigurations.${name}.config.networking.firewall.enable;
+}) nixosConfigurations