refactor(flake): user registry, multi-user hosts, and portable home outputs (#49)

## Summary

Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts.

## Changes

- **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules.
- **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg.
- **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees.
- **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes.
- Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths.

## Fixes

- Closes #46 — shared user module authorized one user's SSH key for every account.
- Closes #47 — git committer identity hardcoded as defaults instead of per-user.
- Closes #48 — EDaaS systemd linger hardcoded to a literal username.

## Verification

- `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations.
- Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change).
- Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds.

## Notes

- `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host).
- A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #49

lib/catppuccin-mocha.nix

@@ -0,0 +1,26 @@
+# Catppuccin Mocha palette. Raw 6-digit hex (no leading "#"); consumers add a
+# "#" where their format needs it. Shared by the Sway desktop theming
+# (home/sway.nix) and the ReGreet greeter (modules/sway.nix) so the two stay in sync.
+{
+  base = "1e1e2e";
+  mantle = "181825";
+  crust = "11111b";
+  surface0 = "313244";
+  surface1 = "45475a";
+  surface2 = "585b70";
+  overlay0 = "6c7086";
+  subtext0 = "a6adc8";
+  subtext1 = "bac2de";
+  text = "cdd6f4";
+  rosewater = "f5e0dc";
+  red = "f38ba8";
+  maroon = "eba0ac";
+  peach = "fab387";
+  yellow = "f9e2af";
+  green = "a6e3a1";
+  teal = "94e2d5";
+  sapphire = "74c7ec";
+  blue = "89b4fa";
+  mauve = "cba6f7";
+  pink = "f5c2e7";
+}