chore: minor cleanups (lens unfree name, LSP doc, editorconfig, docker subnet)

- flake.nix: drop the dead "lens" unfree entry; pkgs.lens is named
  "lens-desktop", which is the name the predicate actually matches.
- home/README.md: the Nix LSP is nil_ls, not nil.
- .editorconfig: remove the rule block that duplicated the [*] defaults.
- hosts/RPi5/docker.nix: name the trusted Docker subnet in a let binding
  rather than repeating the literal CIDR.

Deferred from the audit bundle: the .gitignore firmware entry (documented,
low value) and the per-eval nixpkgs-unstable overlay import (inherently
per-system, no clean hoist).

Closes #53

.editorconfig

@@ -8,12 +8,6 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 
-[*.{nix,yaml,yml,json,md,sh,toml}]
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-insert_final_newline = true
-
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false

flake.nix

@@ -93,8 +93,7 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
-          "lens"
+          "lens-desktop" # the name of pkgs.lens (used on the work host)
-          "lens-desktop"
         ];
 
         # Per-user identity, keyed by username. See README "Users".

home/README.md

@@ -111,7 +111,7 @@ every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
 | Feature        | Notes                                                                                     |
-| -------------- | -------------------------------------------------------------------------------------- |
+| -------------- | ----------------------------------------------------------------------------------------- |
 | Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
 | File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
 | Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
@@ -124,7 +124,7 @@ place of the old (inert) ALE.
 | Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
 | Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
 | Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
 | Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
 | Filetypes      | `*Jenkinsfile` → groovy                                                                   |
 

hosts/RPi5/docker.nix

@@ -8,6 +8,10 @@
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
+let
+  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
+  trustedSubnet = "10.187.1.0/24";
+in
 {
   virtualisation.docker.enable = true;
 
@@ -29,6 +33,6 @@
   # CIDR to match the LAN that should reach the Docker API.
   networking.nftables.enable = true;
   networking.firewall.extraInputRules = ''
-    ip saddr 10.187.1.0/24 tcp dport 2375 accept
+    ip saddr ${trustedSubnet} tcp dport 2375 accept
   '';
 }