feat(deploy): add aarch64 Raspberry Pi 5 target (sd-image)

Proper aarch64 NixOS target for the DIY Pi 5 build, wired additively so
the x86 fleet path is untouched (both the new Pi sd-image and the
existing sintra-installed still evaluate cleanly):

- nixos-hardware input (raspberry-pi-5 module) for Pi kernel/firmware/GPU.
- aarch64 pkgs + pkgs-unstable + mkAtmApp instances (parallel to x86).
- mkPiConfig: aarch64 nixosSystem reusing the shared configuration.nix +
  bitspire-atm service, replicating the installed-config runtime (bitspire
  service, first-boot env seed, electron service override, swap). Drops
  the x86 fleet machinery for a first bring-up: no determinate/autoUpgrade
  (not yet fleet-managed) and no atm-tui (needs an aarch64 package).
- raspberry-pi-5.nix hardware module: extlinux boot, vc4/v3d KMS for X,
  primary UART free for a GPIO-wired validator, no-suspend, and stable
  /dev/ttyValidator* udev symlinks for USB-serial validator adapters
  (Apex 7600 RS-232 via adapter, NV10 USB+).
- nixosConfigurations.rpi5-installed + packages.aarch64-linux.sd-image-rpi5.

BUILD NOTE: the app closure (aarch64 electron/native addons) needs an
aarch64 builder — a native Pi/arm box or `boot.binfmt` qemu emulation on
an x86 host. Config evaluates on x86; it just can't build there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ivBosaWmv8vwFE7ejrdHW

deploy/nixos/hardware/raspberry-pi-5.nix

@@ -0,0 +1,63 @@
+# Raspberry Pi 5 hardware module (aarch64).
+#
+# The bitSpire equivalent of upboard.nix, but for a Pi 5 instead of the x86
+# UP Board. Kernel, firmware, GPU and bootloader come from the nixos-hardware
+# `raspberry-pi-5` module (added alongside this one in flake.nix); here we set
+# only the bitSpire-specific hardware glue: serial for the bill validators,
+# the kiosk display driver, and no-suspend.
+#
+# Wiring the parts (see docs) to a Pi 5:
+#   - Bill validators (Apex 7600 RS-232, NV10 USB+): easiest via one USB-serial
+#     adapter each → stable /dev/ttyValidator* symlinks below. A GPIO-UART wire
+#     is also supported (primary UART enabled, console kept off it).
+#   - QR scanner: USB HID, no config.
+#   - 7" touchscreen: DSI or HDMI; the vc4/v3d KMS driver (from nixos-hardware)
+#     backs X.
+#   - Boot/root: USB-SATA SSD or the SD card.
+{ config, lib, pkgs, ... }:
+
+{
+  # aarch64 target. (The flake instantiates this config with aarch64 pkgs; this
+  # line documents/asserts it.)
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+
+  # Bootloader: the aarch64 sd-image uses the extlinux-compatible generator;
+  # nixos-hardware's rpi5 module wires the firmware/u-boot. No systemd-boot
+  # (that's x86/UEFI, as on the UP Board).
+  boot.loader.grub.enable = lib.mkDefault false;
+  boot.loader.generic-extlinux-compatible.enable = lib.mkDefault true;
+
+  # Primary UART (GPIO 14/15) available for a GPIO-wired validator. Keep the
+  # serial console OFF it so the validator owns the line — mirrors upboard.nix
+  # keeping ttyS4 free for the dispenser. USB-serial adapters are unaffected.
+  boot.kernelParams = lib.mkDefault [ "console=tty0" ];
+
+  # X uses the Pi GPU's kernel modesetting driver (vc4/v3d KMS from
+  # nixos-hardware). Electron renders through it as on the UP Board.
+  services.xserver.videoDrivers = lib.mkDefault [ "modesetting" ];
+
+  hardware.enableRedistributableFirmware = true;
+
+  # Kiosk: never sleep.
+  systemd.targets = {
+    sleep.enable = false;
+    suspend.enable = false;
+    hibernate.enable = false;
+    hybrid-sleep.enable = false;
+  };
+
+  # Stable device symlinks for USB-serial bill-validator adapters, so the ATM
+  # config can point at /dev/ttyValidator0 regardless of enumeration order.
+  # Covers the common bridges (FTDI, Silicon Labs CP210x, WCH CH340). If two
+  # adapters of the SAME chip are used, disambiguate by KERNELS/serial instead —
+  # tune during bring-up. The NV10 USB+ presents its own USB CDC serial; add its
+  # idVendor/idProduct here once known.
+  services.udev.extraRules = lib.mkAfter ''
+    # FTDI (e.g. FT232R) → ttyValidator0
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", SYMLINK+="ttyValidator0"
+    # Silicon Labs CP210x → ttyValidator1
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="ttyValidator1"
+    # WCH CH340 → ttyValidator2
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="7523", SYMLINK+="ttyValidator2"
+  '';
+}