refactor(nix): move flake to repo root 🚚

clan-cli silently ignores the `?dir=` URL parameter when resolving a
flake source, so with the flake at nixos/flake.nix `clan machines
update` fails with "flake.nix does not exist". Move the flake tree up
so the repo root contains flake.nix, flake.lock, flake-modules/, lib/,
modules/, sops/, and vars/. Host-specific NixOS modules stay in
nixos/{hosts,home,fish.nix,neovim.nix,…}; flake-module paths updated
accordingly.

- dotfiles-rebuild flakeRef is now "${dotfilesDir}#<host>" (was
  "${dotfilesDir}/nixos#<host>").
- CLAUDE.md build commands + clan section updated. nixupdate fish alias
  updated. sunken-ship hostsfile comment updated.
- Existing /etc/dotfiles checkouts on the servers will pick up the new
  layout on the next `dotfiles-rebuild` timer tick; the rebuild service
  was pre-updated via rsync so its flakeRef matches before the pull.

Also includes 4b follow-through: zerotier identities are now live on
both servers (sunken-ship=d553a2de33 controller, phantom-ship=6c048abbdc
peer) and IPv6 ping across the ZT mesh works.

nixos/lib/home-manager-user.nix

@@ -1,35 +0,0 @@
-# Shared home-manager wiring for NixOS and nix-darwin hosts.
-#
-# Usage (from a flake-module):
-#   modules = [
-#     inputs.home-manager.nixosModules.home-manager   # or .darwinModules
-#     (import ../lib/home-manager-user.nix {
-#       lib = inputs.nixpkgs.lib;
-#       user = "danny";
-#       homeDirectory = "/home/danny";
-#       stateVersion = "25.11";        # optional
-#       userImports = [ ../home/danny/home.nix ]; # optional
-#     })
-#   ];
-{ lib
-, user
-, homeDirectory
-, stateVersion ? null
-, userImports ? [ ]
-}:
-{
-  home-manager.useGlobalPkgs = true;
-  home-manager.useUserPackages = true;
-  # Automatically back up files before home-manager overwrites them.
-  home-manager.backupFileExtension = "backup";
-  home-manager.users.${user} = { ... }: {
-    imports = userImports;
-    home = {
-      username = user;
-      # Force an absolute path even if another module sets a bad value.
-      homeDirectory = lib.mkForce homeDirectory;
-    } // lib.optionalAttrs (stateVersion != null) {
-      stateVersion = stateVersion;
-    };
-  };
-}