feat(zfs): manage jeeves datasets declaratively from nix

Add a zfs_manager module that reconciles the live datasets on jeeves
against a nix declaration, and generate the snapshot retention config
from that same declaration so the two can no longer drift apart.

systems/jeeves/datasets.nix declares every dataset on the media, storage
and scratch pools, nested the way zfs nests them and flattened into
pool/parent/child names. Values were transcribed from the live pools
rather than from scripts/zfs.sh, which had gone stale: acltype reads back
as posix, and media/secure/important, scratch/kestra and storage/nomad
were never recorded. root_pool datasets are declared for retention only,
their properties stay unmanaged for now.

python.tools.zfs_manager creates missing datasets and corrects drifted
properties, and never destroys anything. Undeclared properties are judged
by the zfs source field, so inherited and default values stay quiet while
locally set ones warn. Size values are normalised to bytes so that 16K and
16384 do not re-issue zfs set on every run.

vars.nix now derives its paths from the declared mountpoints instead of
repeating them, dropping three zfs_* keys that nothing referenced.

Replaces systems/jeeves/snapshot_config.toml, which listed a dataset that
does not exist and omitted thirteen that do.

python/zfs/__init__.py

@@ -1,11 +1,23 @@
 """init."""
 
-from python.zfs.dataset import Dataset, Snapshot, get_datasets
+from python.zfs.dataset import (
+    Dataset,
+    Snapshot,
+    create_dataset,
+    get_datasets,
+    get_properties,
+    list_dataset_names,
+    set_property,
+)
 from python.zfs.zpool import Zpool
 
 __all__ = [
     "Dataset",
     "Snapshot",
     "Zpool",
+    "create_dataset",
     "get_datasets",
+    "get_properties",
+    "list_dataset_names",
+    "set_property",
 ]

python/zfs/dataset.py

@@ -207,8 +207,83 @@ def get_datasets() -> list[Dataset]:
     """
     logger.info("Getting zfs list")
 
+    return [Dataset(dataset_name) for dataset_name in list_dataset_names() if "/" in dataset_name]
+
+
+def get_properties(name: str) -> dict[str, tuple[str, str]]:
+    """Get every property of a dataset along with where its value came from.
+
+    The source is what distinguishes a property that was deliberately set on
+    this dataset from one that is merely inherited or left at its default.
+
+    Args:
+        name (str): The name of the dataset.
+
+    Returns:
+        dict[str, tuple[str, str]]: A mapping of property name to (value, source).
+    """
+    raw_properties, return_code = bash_wrapper(f"zfs get -Hp -o property,value,source all {name}")
+    if return_code != 0:
+        error = f"Failed to get properties for {name}: {raw_properties}"
+        raise RuntimeError(error)
+
+    properties = {}
+    for line in raw_properties.strip().split("\n"):
+        if not line:
+            continue
+        prop, value, source = line.split("\t")
+        properties[prop] = (value, source)
+
+    return properties
+
+
+def create_dataset(name: str, properties: dict[str, str]) -> str | None:
+    """Create a dataset with the given properties.
+
+    Args:
+        name (str): The name of the dataset.
+        properties (dict[str, str]): The properties to create the dataset with.
+
+    Returns:
+        str | None: An error message on failure, None on success.
+    """
+    options = " ".join(f"-o {key}={value}" for key, value in sorted(properties.items()))
+    logger.debug(f"creating {name} with {options}")
+
+    msg, return_code = bash_wrapper(f"zfs create {options} {name}")
+    if return_code != 0:
+        return f"Failed to create {name}: {msg.strip()}"
+    return None
+
+
+def set_property(name: str, key: str, value: str) -> str | None:
+    """Set a single property on a dataset.
+
+    Args:
+        name (str): The name of the dataset.
+        key (str): The property to set.
+        value (str): The value to set the property to.
+
+    Returns:
+        str | None: An error message on failure, None on success.
+    """
+    logger.debug(f"setting {key}={value} on {name}")
+
+    msg, return_code = bash_wrapper(f"zfs set {key}={value} {name}")
+    if return_code != 0:
+        return f"Failed to set {key}={value} on {name}: {msg.strip()}"
+    return None
+
+
+def list_dataset_names() -> list[str]:
+    """List every zfs filesystem name, including pool root filesystems.
+
+    Unlike get_datasets this does not build Dataset objects and does not filter
+    out pool roots, which makes it usable for existence checks.
+
+    Returns:
+        list[str]: The names of every zfs filesystem.
+    """
     dataset_names, _ = bash_wrapper("zfs list -Hp -t filesystem -o name")
 
-    cleaned_datasets = dataset_names.strip().split("\n")
-
-    return [Dataset(dataset_name) for dataset_name in cleaned_datasets if "/" in dataset_name]
+    return [name for name in dataset_names.strip().split("\n") if name]