allow passwordless sudo for ahmza

adds security.sudo.extraRules with NOPASSWD: ALL. the rule is emitted after the default %wheel SETENV rule and sudoers is last-match-wins, so it takes precedence. lives in the shared user module, so it applies to both shadow and t480.

modules/system/core/user.nix

@@ -16,6 +16,18 @@
       # repoPath defaults to /home/ahmza/dot
     };
 
+    security.sudo.extraRules = [
+      {
+        users = ["ahmza"];
+        commands = [
+          {
+            command = "ALL";
+            options = ["NOPASSWD"];
+          }
+        ];
+      }
+    ];
+
     users.users.ahmza = {
       isNormalUser = true;
       initialPassword = "qwer";