Deploy VM Control Centre on liz

[wongcallum]

What to build

The VM Control Centre goes live on liz, controlling the real Windows and vm-gpu guests.

Until now the app has been developed and tested entirely in its own repository against a stub environment, deliberately never using liz as a development environment. This ticket is the single integration commit: add the app flake as an input, import the NixOS module it exports, configure it, and deploy.

The port allowlist must be populated from liz's actual USB topology, with labels that describe the physical sockets in human terms ("front left", "rear top") rather than bare sysfs names. Gather the topology from the machine; do not guess.

Deliberately not included: the gateway registry entry, which is tracked separately.

Application repository: https://github.com/wongcallum/vm-control-centre

Acceptance criteria

• App flake added as an input and its NixOS module imported by liz
• usbPorts populated from liz's real USB topology, with human-meaningful labels
• nix build .#nixosConfigurations.liz.config.system.build.toplevel succeeds
• The rendered JSON descriptor in the built closure is verified to name the correct units, QMP socket paths, and xHCI bus ids for both guests
• nix develop --command bash -c 'treefmt; statix check .; deadnix --fail .' passes
• nix flake check --no-build passes
• Deployed to liz; the service starts under its hardened unit
• Both guests' real states are shown correctly, and switching between them works
• Attaching and detaching a real USB device to the running guest works

Blocked by

• vm-gpu: add an xHCI controller so it can receive USB devices #65
• USB attach and detach, with pending-removal state vm-control-centre#9