AHCI storage for laptop images, plaintext password fix

Laptop images now use AHCI storage + e1000 network instead of VirtIO.
This fixes "inaccessible boot device" on real hardware — the AHCI→NVMe
driver transition is handled by Windows, unlike VirtIO→NVMe which isn't.

- makeImage: useAHCI flag switches disk to ide-hd and network to e1000
- customizeImage: auto-detects useAHCI from original image, propagates it
- win10/win11 laptop images: useAHCI = true
- vmix run: --ahci flag for running laptop images in QEMU
- generalize: PlainText password tags in OOBE unattend XML

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flake.nix

@@ -77,11 +77,13 @@
         RUN_INPUT="$1"; shift
         RUN_MEM=4096
         RUN_SMP=4
+        RUN_AHCI=false
         while [[ ''${#} -gt 0 ]]; do
           case "$1" in
-            --mem) RUN_MEM="$2"; shift 2 ;;
-            --smp) RUN_SMP="$2"; shift 2 ;;
-            *)     echo "Unknown option: $1"; exit 1 ;;
+            --mem)  RUN_MEM="$2"; shift 2 ;;
+            --smp)  RUN_SMP="$2"; shift 2 ;;
+            --ahci) RUN_AHCI=true; shift ;;
+            *)      echo "Unknown option: $1"; exit 1 ;;
           esac
         done
 
@@ -115,8 +117,12 @@
           -drive if=pflash,format=raw,file=/tmp/vmix-run-vars-$$.fd \
           -rtc base=localtime,clock=host \
           -device qemu-xhci -device usb-tablet \
-          -drive file="$RUN_IMAGE",format=qcow2,if=virtio,snapshot=on \
-          -nic user,model=virtio-net-pci \
+          $(if [[ "$RUN_AHCI" == "true" ]]; then
+            echo "-drive file=$RUN_IMAGE,format=qcow2,if=none,id=disk0,snapshot=on -device ide-hd,drive=disk0"
+          else
+            echo "-drive file=$RUN_IMAGE,format=qcow2,if=virtio,snapshot=on"
+          fi) \
+          -nic user,model=$(if [[ "$RUN_AHCI" == "true" ]]; then echo e1000; else echo virtio-net-pci; fi) \
           -device virtio-serial-pci \
           -chardev spicevmc,id=vdagent,debug=0,name=vdagent \
           -device virtserialport,chardev=vdagent,name=com.redhat.spice.0