feat: Add fingerprint scanner support and modularize work configurations

- Add fingerprint.nix hardware module with TOD driver support
- Create separate laptop-work configuration with Cisco, Himmelblau, and MDATP work modules
- Move work-specific modules from shared to laptop-work profile
- Change work module enable defaults to false for better security-by-default
- Add MDATP support with enhanced modular structure

hosts/default.nix

@@ -18,7 +18,7 @@
   # get these into the module system
   specialArgs = {inherit inputs self;};
 
-  # shared modules for all configurations
+  # shared modules for all configurations (personal + work)
   sharedModules = [
     ./aesthetic
     "${mod}/services/gnome-services.nix"
@@ -26,11 +26,6 @@
     "${home}"
     "${self}/work"
     inputs.sops-nix.nixosModules.sops
-    inputs.himmelblau.nixosModules.himmelblau
-    inputs.mdatp.nixosModules.mdatp
-    {
-      services.mdatp.enable = true;
-    }
   ];
 in {
   flake.nixosConfigurations = {
@@ -86,6 +81,22 @@ in {
         ];
     };
 
+    # Laptop work: laptop profile + work modules (himmelblau, cisco, mdatp)
+    laptop-work = nixosSystem {
+      inherit specialArgs;
+      modules =
+        laptop
+        ++ sharedModules
+        ++ [
+          "${mod}/services/location.nix"
+          {
+            work.cisco.enable = true;
+            work.himmelblau.enable = true;
+            work.mdatp.enable = true;
+          }
+        ];
+    };
+
     # Server: severijnse.eu (Hetzner) — fully isolated under servers/hetzner/.
     # Uses nixos-24.05 + disko + sops-nix and does NOT inherit the laptop's shared modules.
     hetzner = nixosSystem24 {