refactor(flake): user registry, multi-user hosts, and portable home outputs (#49)

## Summary

Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts.

## Changes

- **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules.
- **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg.
- **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees.
- **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes.
- Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths.

## Fixes

- Closes #46 — shared user module authorized one user's SSH key for every account.
- Closes #47 — git committer identity hardcoded as defaults instead of per-user.
- Closes #48 — EDaaS systemd linger hardcoded to a literal username.

## Verification

- `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations.
- Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change).
- Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds.

## Notes

- `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host).
- A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #49

home/git.nix

@@ -0,0 +1,114 @@
+# Version control: git + delta + commitizen + lazygit. Committer identity comes
+# from the per-user `identity` arg (the registry). See README "Users".
+{
+  pkgs,
+  lib,
+  identity,
+  ...
+}:
+let
+  ctp = import ../lib/catppuccin-mocha.nix;
+in
+{
+  home.packages = [
+    pkgs.commitizen
+  ];
+
+  programs.git = {
+    enable = true;
+    package = pkgs.gitFull;
+    settings = {
+      user.name = identity.fullName;
+      # mkDefault so a host-specific module can still override it.
+      user.email = lib.mkDefault identity.email;
+      push.autoSetupRemote = true;
+      init.defaultBranch = "main";
+
+      # Rebase-centric pulls (matches the "always a branch, linear history"
+      # workflow); stash/restore and reorder fixups automatically.
+      pull.rebase = true;
+      rebase = {
+        autoStash = true;
+        autoSquash = true;
+      };
+
+      fetch.prune = true; # drop deleted remote-tracking branches
+      # Keep the commit-graph current (fast `git log --graph`, used by `lg`).
+      fetch.writeCommitGraph = true;
+      gc.writeCommitGraph = true;
+      merge.conflictStyle = "zdiff3"; # show the common ancestor in conflicts
+      diff = {
+        algorithm = "histogram";
+        colorMoved = "default";
+      };
+      rerere.enabled = true; # remember + replay conflict resolutions
+
+      # delta pager config (programs.delta is enabled below, with git
+      # integration; these keys land under [delta] in the git config).
+      # syntax-theme reuses the Catppuccin Mocha tmTheme vendored for bat in
+      # shell.nix -- delta reads bat's theme directory.
+      delta = {
+        syntax-theme = "Catppuccin Mocha";
+        navigate = true; # n/N to jump between diff hunks
+        line-numbers = true;
+        side-by-side = true;
+      };
+      commit.verbose = true; # full diff in the commit-message editor
+      branch.sort = "-committerdate"; # most-recent branches first
+      column.ui = "auto";
+      help.autocorrect = "prompt";
+
+      alias = {
+        st = "status";
+        co = "checkout";
+        sw = "switch";
+        br = "branch";
+        ci = "commit";
+        last = "log -1 HEAD";
+        unstage = "reset HEAD --";
+        amend = "commit --amend --no-edit"; # tack staged changes onto HEAD
+        fixup = "commit --fixup"; # `git fixup <sha>` -> autosquash on next rebase
+        undo = "reset --soft HEAD~1"; # undo last commit, keep the changes staged
+        lg = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(auto)%d%C(reset)' --all";
+        # commitizen (Conventional Commits, its default ruleset): `git cz c` ->
+        # `cz commit`, `git cz bump`, etc. `git cc` is a shortcut for the prompt.
+        cz = "!cz";
+        cc = "!cz commit";
+      };
+
+      # SSH signing, key from the registry. mkDefault so a host lacking the key
+      # in its agent can set gpgsign = false instead of failing every commit.
+      gpg.format = "ssh";
+      user.signingkey = lib.mkDefault identity.signingKey;
+      commit.gpgsign = lib.mkDefault true;
+      tag.gpgsign = lib.mkDefault true;
+    };
+
+    # Global ignore file (~/.config/git/ignore).
+    ignores = [
+      "result"
+      "result-*"
+      ".direnv"
+      "*.swp"
+      ".DS_Store"
+    ];
+  };
+
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
+  };
+
+  # lazygit: TUI for staging/rebasing, themed to Catppuccin Mocha to match.
+  programs.lazygit = {
+    enable = true;
+    settings.gui.theme = {
+      activeBorderColor = [
+        "#${ctp.blue}"
+        "bold"
+      ];
+      inactiveBorderColor = [ "#${ctp.surface1}" ];
+      selectedLineBgColor = [ "#${ctp.surface0}" ];
+    };
+  };
+}