CachyOS Server Edition and Installation

## Plan

* **Docs → CLI installer (roles):** Start with a short manual server install guide; follow with a CLI/TUI installer offering roles: **minimal**, **web**, **container-host**, **db**.
* **Defaults:** Ship `cachyos-server-settings` (nftables default-deny+SSH, hardened sshd drop-in, safe sysctl, networkd/resolved).
* **Hardening drop-ins:** Provide example `.service.d` configs for nginx/httpd/php-fpm/sshd/postgresql (easy opt-in).
* **Performance (PGO):** Pilot PGO builds for **nginx** and **PostgreSQL** (stretch: httpd, PHP).
* **Images:** Publish minimal server images (**qcow2**, **raw**, **vmdk**, **vhdx**) with serial console, optional cloud-init.
* **Updates:** Optional timer for unattended upgrades (kernel excluded by default).

## Checklist

* [ ] Manual server guide + `cachyos-server-settings`
* [ ] CLI installer with roles
* [x] Hardened systemd drop-ins shipped
* [x] PGO pilot: nginx + PostgreSQL
* [ ] Provider images (qcow2/raw; vmdk/vhdx later)
* [ ] Opt-in auto-update timer (kernel ignored)

**Acceptance (short):** Fresh minimal role boots headless with sshd+nftables+networkd/resolved; SSH key-only; firewall default-deny except SSH; role services start and work OOB; PGO pilot shows measurable wins.