Fix OpenClaw gateway launch: binary renamed openclaw, add gateway subcommand

The nix-openclaw package renamed the binary from openclaw-gateway to
openclaw, and the gateway now runs as a subcommand. Also adds CLAUDE.md
and openclaw-todo.md.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openclaw-todo.md

@@ -0,0 +1,48 @@
+# OpenClaw Setup TODO
+
+## Current state
+
+OpenClaw is **already fully wired** into the macOS (Daniel-Macbook-Air) darwin config:
+
+- **Keep:** `nix-openclaw` flake input, overlay, home-manager module import — all correct
+- **Keep:** `nixos/home/danny/openclaw.nix` — working config with launchd agent, wrapper, documents integration
+- **Keep:** `openclaw-gateway-wrapper.sh` — loads gateway token from `~/.secrets/` at runtime
+- **Keep:** `openclaw-allow-from.nix` (gitignored) — Telegram user ID allowlist
+- **Scrap/fix:** `home.activation.backupOpenclawBeforeSwitch` — marked as bloat in a TODO; remove once confirmed unnecessary
+- **Not wired:** `sunken-ship` and `macbookair` NixOS configs have zero OpenClaw references
+
+## Phase 1: Get OpenClaw running on macOS (Daniel-Macbook-Air)
+
+- [ ] Ensure `openclaw-documents-repo` exists at `~/dotfiles/openclaw-documents-repo` (or clone it)
+- [ ] Create secrets:
+  - `~/.secrets/telegram-bot-token` (from @BotFather)
+  - `~/.secrets/openclaw-gateway-token` (gateway auth token)
+- [ ] Copy `openclaw-allow-from.nix.example` → `openclaw-allow-from.nix`, fill in Telegram user ID(s)
+- [ ] Rebuild: `cd ~/dotfiles/nixos && darwin-rebuild switch --flake .`
+- [ ] Verify launchd agent: `launchctl list | grep openclaw`
+- [ ] Test: message bot on Telegram
+- [ ] Verify Ollama integration: `ollama list` (already enabled via `macos.nix` → `ollama.nix`)
+
+## Phase 2: Move to dedicated server (sunken-ship or new host)
+
+- [ ] **Decide:** run OpenClaw on sunken-ship (existing) or a new host (phantom-ship)?
+- [ ] Add `nix-openclaw` + `openclaw-documents` to the NixOS config's `specialArgs` (currently only passed to darwinConfigurations)
+- [ ] Port `openclaw.nix` from home-manager launchd agent → systemd user service (or system service)
+  - Replace `launchd.agents` block with `systemd.user.services` equivalent
+  - Update wrapper to use systemd `EnvironmentFile=` instead of bash wrapper
+- [ ] Handle secrets on server:
+  - `scp` token files to server `~/.secrets/` (don't commit)
+  - Or use `agenix`/`sops-nix` for encrypted secrets in repo
+- [ ] Decide on documents: clone `openclaw-documents-repo` on server, or use GitHub flake input instead of local path
+- [ ] If Ollama needed on server: port `ollama.nix` (launchd → systemd) or use nixpkgs `services.ollama` (available in NixOS, not nix-darwin)
+- [ ] Rebuild on server: `sudo nixos-rebuild switch --flake .#sunken-ship`
+
+## Packaging decisions
+
+| Decision | Current | Options |
+|---|---|---|
+| OpenClaw binary | `nix-openclaw` flake input | **Keep** — gives overlay + HM module |
+| Documents | Local path flake input | Local path for dev, switch to `github:` for server |
+| Ollama on macOS | Custom `ollama.nix` (PR #972) | **Keep** until nix-darwin merges upstream |
+| Ollama on NixOS | Not configured | Use `services.ollama` from nixpkgs (built-in on NixOS) |
+| Secrets | Files in `~/.secrets/` | Fine for now; consider `sops-nix` if adding more |