refactor(nix): auto-load flake-modules + extract shared dotfiles-rebuild 🌳

- Add import-tree input; flake.nix now auto-loads every file under
  ./flake-modules so new hosts/features drop in without editing flake.nix.
- Extract the duplicated dotfiles-rebuild service, timer, and
  safe.directory wiring into nixos/modules/dotfiles-rebuild.nix, exposed
  via flake.nixosModules.dotfiles-rebuild.
- sunken-ship and phantom-ship now pull it in from their flake-modules;
  hostname-specific flakeRef is derived from config.networking.hostName.

nixos/flake-modules/nixos-modules.nix

@@ -0,0 +1,7 @@
+# Expose reusable NixOS modules via `flake.nixosModules`.
+#
+# Consume from a host's flake-module via:
+#   modules = [ config.flake.nixosModules.dotfiles-rebuild ];
+{ ... }: {
+  flake.nixosModules.dotfiles-rebuild = ../modules/dotfiles-rebuild.nix;
+}

nixos/flake-modules/phantom-ship.nix

@@ -1,9 +1,10 @@
-{ inputs, ... }: {
+{ inputs, config, ... }: {
   flake.nixosConfigurations.phantom-ship = inputs.nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
     modules = [
       inputs.nix-openclaw.nixosModules.openclaw-gateway
       ../hosts/phantom-ship.nix
+      config.flake.nixosModules.dotfiles-rebuild
 
       inputs.home-manager.nixosModules.home-manager
       (import ../lib/home-manager-user.nix {

nixos/flake-modules/sunken-ship.nix

@@ -1,8 +1,9 @@
-{ inputs, ... }: {
+{ inputs, config, ... }: {
   flake.nixosConfigurations.sunken-ship = inputs.nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
     modules = [
       ../hosts/sunken-ship.nix
+      config.flake.nixosModules.dotfiles-rebuild
 
       inputs.home-manager.nixosModules.home-manager
       (import ../lib/home-manager-user.nix {