feat: fde-lock endpoint for home assistant, init_on_free

hardware-configuration.nix

@@ -22,6 +22,7 @@
 
     # helps isolate PCIe ports if your card shares groups
     "pci_acs_override=downstream,multifunction"
+    "init_on_free=1" # zero freed pages (fde-lock: no key material left behind)
   ];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];