The daemon enable and the firewall port were duplicated in each sshd host (T400, Mac Pro, RPi5). Move both into modules/ssh.nix so importing it both hardens and enables sshd; drop the per-host copies. No build change: the three hosts evaluate to identical derivations. Closes #51