nix: one Hetzner host for the CI server + the orchestrator (#cc-ci)

The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).

nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.

README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

flake.lock

@@ -1,5 +1,29 @@
 {
   "nodes": {
+    "cc-ci": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "sops-nix": [
+          "sops-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788811018,
+        "narHash": "sha256-Vc7RSeqFHCwlVRhnEEjavuJoyIID+RQdJSygHNA8s8Y=",
+        "ref": "feat/nixos-module-export",
+        "rev": "9b99f81f5f20bde865549912a03ff59ac89b2d7c",
+        "revCount": 1532,
+        "type": "git",
+        "url": "https://git.autonomic.zone/recipe-maintainers/cc-ci.git"
+      },
+      "original": {
+        "ref": "feat/nixos-module-export",
+        "type": "git",
+        "url": "https://git.autonomic.zone/recipe-maintainers/cc-ci.git"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1785734586,
@@ -18,6 +42,7 @@
     },
     "root": {
       "inputs": {
+        "cc-ci": "cc-ci",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix"
       }