refactor: Move sw into properly nested modules with unconditional import

sw/headless/default.nix

@@ -11,21 +11,47 @@
   ...
 }:
 
-lib.mkMerge [
-  (import ./programs.nix {
-    inherit
-      config
-      lib
-      pkgs
-      inputs
-      ;
-  })
-  (import ./services.nix {
-    inherit
-      config
-      lib
-      pkgs
-      inputs
-      ;
-  })
-]
+with lib;
+
+let
+  cfg = config.athenix.sw.headless;
+in
+{
+  options.athenix.sw.headless = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable minimal headless server configuration.
+
+        Includes:
+        - SSH server with password authentication
+        - Minimal CLI tools (tmux, man)
+        - Systemd-networkd for networking
+        - No graphical environment
+
+        Recommended for: Servers, containers (LXC), WSL, remote systems
+      '';
+      example = true;
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    (import ./programs.nix {
+      inherit
+        config
+        lib
+        pkgs
+        inputs
+        ;
+    })
+    (import ./services.nix {
+      inherit
+        config
+        lib
+        pkgs
+        inputs
+        ;
+    })
+  ]);
+}