refactor(nix): auto-load flake-modules + extract shared dotfiles-rebuild 🌳

- Add import-tree input; flake.nix now auto-loads every file under
  ./flake-modules so new hosts/features drop in without editing flake.nix.
- Extract the duplicated dotfiles-rebuild service, timer, and
  safe.directory wiring into nixos/modules/dotfiles-rebuild.nix, exposed
  via flake.nixosModules.dotfiles-rebuild.
- sunken-ship and phantom-ship now pull it in from their flake-modules;
  hostname-specific flakeRef is derived from config.networking.hostName.

nixos/modules/dotfiles-rebuild.nix

@@ -0,0 +1,44 @@
+# Shared auto-rebuild-from-git service for homelab hosts.
+#
+# Every 15 min: git fetch origin, fast-forward main, and if there were any
+# new commits run nixos-rebuild switch against `<dotfilesDir>/nixos#<host>`.
+#
+# Assumes /etc/dotfiles is an already-cloned checkout of the dotfiles repo.
+{ config, lib, pkgs, ... }:
+let
+  dotfilesDir = "/etc/dotfiles";
+  flakeRef = "${dotfilesDir}/nixos#${config.networking.hostName}";
+in {
+  environment.systemPackages = [ pkgs.git ];
+
+  # Trust /etc/dotfiles as root even though it's owned by `danny`.
+  # nix/libgit2 reads safe.directory from /etc/gitconfig; the GIT_CONFIG_*
+  # env vars on the service only affect the git CLI, not nix.
+  programs.git.enable = true;
+  programs.git.config.safe.directory = [ dotfilesDir ];
+
+  systemd.services.dotfiles-rebuild = {
+    description = "Pull dotfiles and run nixos-rebuild if repo changed";
+    path = with pkgs; [ git nix nixos-rebuild ];
+    environment.GIT_CONFIG_COUNT = "1";
+    environment.GIT_CONFIG_KEY_0 = "safe.directory";
+    environment.GIT_CONFIG_VALUE_0 = dotfilesDir;
+    script = ''
+      set -euo pipefail
+      cd ${dotfilesDir}
+      git fetch origin
+      if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ]; then
+        exit 0
+      fi
+      git pull origin main
+      exec nixos-rebuild switch --flake ${flakeRef}
+    '';
+    serviceConfig.Type = "oneshot";
+  };
+
+  systemd.timers.dotfiles-rebuild = {
+    wantedBy = [ "timers.target" ];
+    timerConfig.OnCalendar = "*-*-* *:00/15:00";  # every 15 minutes
+    timerConfig.RandomizedDelaySec = "2min";
+  };
+}