chore: post-refactor cleanups (#50-#53) (#54)

## Summary

Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).

## Changes

- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.

## Deferred (from #53, noted in the commit)

- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.

## Verification

- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).

Closes #50, #51, #52, #53.

---------

Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54

home/README.md

@@ -110,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on
 every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
-| Feature        | Notes                                                                                  |
-| -------------- | -------------------------------------------------------------------------------------- |
-| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                    |
-| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                               |
-| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers   |
-| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)  |
-| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                      |
-| Diagnostics    | inline + trouble list (`<leader>xx`)                                                   |
-| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                              |
-| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                |
-| Statusline     | lualine (Catppuccin theme)                                                             |
-| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects               |
-| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes           |
-| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)            |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
-| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on          |
-| Filetypes      | `*Jenkinsfile` → groovy                                                                |
+| Feature        | Notes                                                                                     |
+| -------------- | ----------------------------------------------------------------------------------------- |
+| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
+| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
+| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
+| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)     |
+| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                         |
+| Diagnostics    | inline + trouble list (`<leader>xx`)                                                      |
+| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                                 |
+| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                   |
+| Statusline     | lualine (Catppuccin theme)                                                                |
+| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
+| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
+| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
+| Filetypes      | `*Jenkinsfile` → groovy                                                                   |
 
 Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
 the file-tree toggle are listed in