feat(macpro31): NVIDIA Quadro P400 driver and CUDA-enabled Docker

The stock GPU has been replaced with a Quadro P400 (Pascal, GP108). Add
hosts/MacPro31/nvidia.nix:

- Driver branch 580 (nvidiaPackages.legacy_580), not the nixpkgs default
  production branch (595.x). 580 is the last branch supporting
  Maxwell/Pascal/Volta and is an LTS branch until Aug 2028; a newer one
  does not drive this card.
- modesetting.enable for Wayland (nvidia-drm.modeset=1), open = false
  (the open kernel modules need Turing or later), and sway
  --unsupported-gpu, which wlroots requires with the proprietary driver.
- Docker with GPU access via CDI (hardware.nvidia-container-toolkit),
  rather than the deprecated virtualisation.docker.enableNvidia runtime
  wrapper. Containers run with --device=nvidia.com/gpu=all and must ship
  a CUDA 12.x or older runtime: CUDA 13 dropped sm_61.

The driver packages are unfree, so allowlist them in unfreePackages; they
are not cached and the kernel module builds on the host.

Also declare features.cpu.microarchLevel = 1 for this machine: the
Harpertown Xeons have SSE4.1 but no SSE4.2/POPCNT, which switches off
Claude Code through the fleet-wide gate.

flake.nix

@@ -111,8 +111,14 @@
         ];
 
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
+        # The NVIDIA entries are for the Mac Pro's Quadro P400 (hosts/MacPro31/
+        # nvidia.nix); unfree packages are not in the binary cache, so the
+        # kernel module is compiled on the host.
         unfreePackages = [
           "claude-code"
+          "nvidia-x11"
+          "nvidia-kernel-modules"
+          "nvidia-settings"
         ];
 
         # Per-user identity, keyed by username. See README "Users".