fix: Lazily fetch external modules only if needed

fleet/fleet-option.nix

@@ -125,21 +125,45 @@ let
         type = lib.types.nullOr (
           lib.types.oneOf [
             lib.types.path
-            lib.types.package
-            lib.types.attrs
+            (lib.types.submodule {
+              options = {
+                url = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Git repository URL to fetch user configuration from.";
+                  example = "https://github.com/username/dotfiles";
+                };
+                rev = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Git commit hash, tag, or branch to fetch.";
+                  example = "abc123def456...";
+                };
+                submodules = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = "Whether to fetch Git submodules.";
+                };
+              };
+            })
           ]
         );
         default = null;
         description = ''
           External user configuration module from Git or local path.
 
+          Can be either:
+          - A local path: /path/to/config
+          - A Git repository: { url = "..."; rev = "..."; submodules? = false; }
+
+          The Git repository is only fetched when the user is actually enabled.
+
           Should contain user.nix (user options + home-manager config)
           and optionally nixos.nix (system-level config).
         '';
         example = lib.literalExpression ''
-          builtins.fetchGit {
+          {
                     url = "https://github.com/username/dotfiles";
-                    rev = "abc123...";
+                    rev = "abc123def456789abcdef0123456789abcdef012";
+                    submodules = false;
                   }'';
       };
       opensshKeys = lib.mkOption {