Fix Tailscale: separate systemd service for mesh connection

Problem: extraUpFlags in services.tailscale blocks boot if network
is not ready or Headscale is unreachable.

Solution:
- services.tailscale.enable = true (installs tailscale)
- Separate kawa-mesh-connect systemd service:
  - Waits for network-online.target
  - Waits for tailscaled.service
  - Connects to mesh after boot

Commands to verify:
  systemctl status tailscaled
  systemctl status kawa-mesh-connect
  tailscale status

modules/kawa-physical.nix

@@ -7,25 +7,34 @@
   # Hostname FIXE (pas de lecture /sys - mode pur)
   networking.hostName = "kawa-honor-v4";
 
-  # Activation de Tailscale
+  # === TAILSCALE - Installation de base ===
   services.tailscale = {
     enable = true;
-    extraUpFlags = [
-      "--login-server=https://headscale.du-senegal.com"
-      "--authkey=f43f36ef159b3df799eb316b81bdac1b415c7cc2add174d0"
-      "--force-reauth"
-    ];
+    package = pkgs.tailscale;
   };
 
-  # CONFIGURATION OLLAMA CPU UNIQUEMENT
+  # Service systemd pour connexion au mesh APRÈS le boot
+  systemd.services.kawa-mesh-connect = {
+    description = "KAWA Mesh Auto-Connect";
+    after = [ "network-online.target" "tailscaled.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.tailscale}/bin/tailscale up --login-server=https://headscale.du-senegal.com --authkey=f43f36ef159b3df799eb316b81bdac1b415c7cc2add174d0 --force-reauth";
+    };
+  };
+
+  # OLLAMA CPU UNIQUEMENT
   services.ollama = {
     enable = true;
-    acceleration = null; # Force le mode CPU uniquement
+    acceleration = null;
     host = "0.0.0.0";
     port = 11434;
   };
 
-  # SSH activé avec PermitRootLogin pour debug
+  # SSH
   services.openssh = {
     enable = true;
     settings = {
@@ -34,38 +43,26 @@
     };
   };
 
-  # NATS Client (option corrigée)
+  # NATS
   services.nats = {
     enable = true;
-    server = "100.64.0.1:4222";
+    settings = {
+      port = 4222;
+      http_port = 8222;
+    };
   };
 
-  # Syncthing pour synchronisation
+  # Syncthing
   services.syncthing = {
     enable = true;
     user = "kawa";
     group = "kawa";
-    config = {
-      devices = {
-        "vps-7ed4abb0" = { id = "AHF53QZ-ZYCQ2K7-556QBZ2-2UAYZL4-QNEQOGZ-PHZQIAG-4ZRXI3P-QLLJNA6"; };
-      };
-      folders = {
-        "kawa-memory" = {
-          path = "/home/kawa/.local/share/kawa/memory";
-          devices = [ "vps-7ed4abb0" ];
-        };
-        "kawa-workspace" = {
-          path = "/home/kawa/.local/share/kawa/workspace";
-          devices = [ "vps-7ed4abb0" ];
-        };
-      };
-    };
   };
 
-  # Utilisateur KAWA
+  # Utilisateur
   users.users.kawa = {
     isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" "tailscale" "syncthing" ];
+    extraGroups = [ "wheel" "networkmanager" "tailscale" ];
     initialPassword = "kawa2026";
   };
 
@@ -76,15 +73,8 @@
     trustedInterfaces = [ "tailscale0" ];
   };
 
-  # Packages système
+  # Packages
   environment.systemPackages = with pkgs; [
-    git
-    vim
-    tailscale
-    ollama
-    nats-cli
-    curl
-    wget
-    htop
+    git vim tailscale ollama nats-cli curl wget htop
   ];
 }