feat(09-01): add work-cli home-manager module

- enable option, jira/vault sub-enables
- all config options matching config.py schema
- generates ~/.config/work/config.toml via home.file
- wires bash completion via programs.bash.initExtra
- package installed from inputs.work-cli.packages

home/hosts/work/packages.local.nix

@@ -0,0 +1,43 @@
+{ pkgs, ... }:
+
+with pkgs;
+let
+  nodejs = [
+    biome
+    tsx
+  ];
+  oasdiff = buildGoModule rec {
+    pname = "oasdiff";
+    version = "1.11.10";
+    src = fetchFromGitHub {
+      owner = "oasdiff";
+      repo = "oasdiff";
+      rev = "v${version}";
+      hash = "sha256-/Pk2mKzdYKl51RvEkm5yRDMHz2vISgoHlnel+llDJus=";
+    };
+    vendorHash = "sha256-ZKs9Ai8Q9Yj4V9GIufYRh9cl3ZUKnSehwpaodyGXtfg=";
+  };
+  misc = [
+    curl
+    flameshot
+    fzf-git-sh
+    git-machete
+    gitlab-ci-local
+    go
+    lua
+    ngrok
+    oasdiff
+    responder
+    rustlings
+    sleuthkit
+    vault-bin
+    xclip
+    xmage
+    # xwayland-satellite
+    # (python314.withPackages (ppkgs: [
+    #   ppkgs.plyer
+    #   ppkgs.dbus-python
+    # ]))
+  ];
+in
+misc ++ nodejs

home/modules/networking/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  config = {
+    home.packages = with pkgs; [
+      wireshark
+    ];
+  };
+}

home/modules/work-cli/default.nix

@@ -0,0 +1,110 @@
+{
+  lib,
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  cfg = config.programs.work-cli;
+  workCliPkg = inputs.work-cli.packages.${pkgs.system}.default;
+in
+{
+  options.programs.work-cli = {
+    enable = lib.mkEnableOption "work-cli unified developer workflow CLI";
+
+    general = {
+      defaultBranch = lib.mkOption {
+        type = lib.types.str;
+        default = "main";
+        description = "Default git branch name";
+      };
+    };
+
+    gitlab = {
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "https://gitlab.com";
+        description = "GitLab instance URL";
+      };
+
+      project = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "GitLab project path (namespace/repo)";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "GitLab group path";
+      };
+    };
+
+    jira = {
+      enable = lib.mkEnableOption "jira integration";
+
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Jira instance URL";
+      };
+
+      projectKey = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Jira project key";
+      };
+    };
+
+    vault = {
+      enable = lib.mkEnableOption "vault integration";
+
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Vault instance URL";
+      };
+    };
+
+    repos = {
+      path = lib.mkOption {
+        type = lib.types.str;
+        default = "~/work";
+        description = "Local path where repos are cloned";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ workCliPkg ];
+
+    home.file.".config/work/config.toml".text = ''
+      [general]
+      default_branch = "${cfg.general.defaultBranch}"
+
+      [gitlab]
+      url = "${cfg.gitlab.url}"
+      project = "${cfg.gitlab.project}"
+      group = "${cfg.gitlab.group}"
+
+      [repos]
+      path = "${cfg.repos.path}"
+    ''
+    + lib.optionalString cfg.jira.enable ''
+
+      [jira]
+      url = "${cfg.jira.url}"
+      project_key = "${cfg.jira.projectKey}"
+    ''
+    + lib.optionalString cfg.vault.enable ''
+
+      [vault]
+      url = "${cfg.vault.url}"
+    '';
+
+    programs.bash.initExtra = ''
+      eval "$(${workCliPkg}/bin/work --show-completion bash 2>/dev/null)"
+    '';
+  };
+}