refactor(flake): add user registry and multi-user host support

Separate user identity (data) from the reusable modules, and let a host
declare any number of users instead of exactly one.

- users/registry.nix: per-user identity (name, email, groups, authorized
  and signing keys) as the single source of identity; no user data is
  hardcoded in the modules.
- mkHost takes a `users` set keyed by username; per-user identity is
  injected into each home config via the `identity` module arg
  (extraSpecialArgs is per-host, so it cannot carry per-user data).
- modules/users.nix builds accounts from the registry; modules/ssh.nix no
  longer defines authorized keys (the registry owns them); home/git.nix
  and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops
  its now-redundant git identity override.
- Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the
  former lyrathorpe/ and system/ layout.
- Add standalone homeConfigurations (the portable subset: shell, git,
  editor, claude) and an exported homeModules output for use on machines
  not managed by this flake, or as an input to other flakes.

Behaviour-preserving for existing hosts: lyrathorpe-mbp and
emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400,
lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a
repeated authorized_keys entry. Fixes the SSH authorized-key leak (one
user's key was applied to every account), the hardcoded default git
identity, and the hardcoded EDaaS linger setting.

home/git.nix

@@ -0,0 +1,117 @@
+# Version control: git + delta pager + commitizen + lazygit. The committer
+# identity (name, email, signing key) comes from the per-user `identity` arg,
+# derived from the registry (users/registry.nix) by mkHost.
+{
+  pkgs,
+  lib,
+  identity,
+  ...
+}:
+let
+  ctp = import ../lib/catppuccin-mocha.nix;
+in
+{
+  home.packages = [
+    pkgs.commitizen
+  ];
+
+  programs.git = {
+    enable = true;
+    package = pkgs.gitFull;
+    settings = {
+      user.name = identity.fullName;
+      # Identity from the registry. mkDefault so a host-specific module can still
+      # override it without conflicting.
+      user.email = lib.mkDefault identity.email;
+      push.autoSetupRemote = true;
+      init.defaultBranch = "main";
+
+      # Rebase-centric pulls (matches the "always a branch, linear history"
+      # workflow); stash/restore and reorder fixups automatically.
+      pull.rebase = true;
+      rebase = {
+        autoStash = true;
+        autoSquash = true;
+      };
+
+      fetch.prune = true; # drop deleted remote-tracking branches
+      # Keep the commit-graph current (fast `git log --graph`, used by `lg`).
+      fetch.writeCommitGraph = true;
+      gc.writeCommitGraph = true;
+      merge.conflictStyle = "zdiff3"; # show the common ancestor in conflicts
+      diff = {
+        algorithm = "histogram";
+        colorMoved = "default";
+      };
+      rerere.enabled = true; # remember + replay conflict resolutions
+
+      # delta pager config (programs.delta is enabled below, with git
+      # integration; these keys land under [delta] in the git config).
+      # syntax-theme reuses the Catppuccin Mocha tmTheme vendored for bat in
+      # shell.nix -- delta reads bat's theme directory.
+      delta = {
+        syntax-theme = "Catppuccin Mocha";
+        navigate = true; # n/N to jump between diff hunks
+        line-numbers = true;
+        side-by-side = true;
+      };
+      commit.verbose = true; # full diff in the commit-message editor
+      branch.sort = "-committerdate"; # most-recent branches first
+      column.ui = "auto";
+      help.autocorrect = "prompt";
+
+      alias = {
+        st = "status";
+        co = "checkout";
+        sw = "switch";
+        br = "branch";
+        ci = "commit";
+        last = "log -1 HEAD";
+        unstage = "reset HEAD --";
+        amend = "commit --amend --no-edit"; # tack staged changes onto HEAD
+        fixup = "commit --fixup"; # `git fixup <sha>` -> autosquash on next rebase
+        undo = "reset --soft HEAD~1"; # undo last commit, keep the changes staged
+        lg = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(auto)%d%C(reset)' --all";
+        # commitizen (Conventional Commits, its default ruleset): `git cz c` ->
+        # `cz commit`, `git cz bump`, etc. `git cc` is a shortcut for the prompt.
+        cz = "!cz";
+        cc = "!cz commit";
+      };
+
+      # SSH commit signing, key from the registry. mkDefault on the key and on
+      # gpgsign so a host without that key in its ssh-agent can override gpgsign
+      # to false rather than fail every commit.
+      gpg.format = "ssh";
+      user.signingkey = lib.mkDefault identity.signingKey;
+      commit.gpgsign = lib.mkDefault true;
+      tag.gpgsign = lib.mkDefault true;
+    };
+
+    # Global ignore file (~/.config/git/ignore).
+    ignores = [
+      "result"
+      "result-*"
+      ".direnv"
+      "*.swp"
+      ".DS_Store"
+    ];
+  };
+
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
+  };
+
+  # lazygit: TUI for staging/rebasing, themed to Catppuccin Mocha to match.
+  programs.lazygit = {
+    enable = true;
+    settings.gui.theme = {
+      activeBorderColor = [
+        "#${ctp.blue}"
+        "bold"
+      ];
+      inactiveBorderColor = [ "#${ctp.surface1}" ];
+      selectedLineBgColor = [ "#${ctp.surface0}" ];
+    };
+  };
+}