refactor(ssh): consolidate sshd enable and port 22 into modules/ssh.nix

The daemon enable and the firewall port were duplicated in each sshd host
(T400, Mac Pro, RPi5). Move both into modules/ssh.nix so importing it both
hardens and enables sshd; drop the per-host copies. No build change: the
three hosts evaluate to identical derivations.

Closes #51

hosts/T400/configuration.nix

@@ -21,10 +21,8 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # laptop.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and