nix: add cc-ci-hetzner host (cpx32, nixos-infect hardware, all root SSH keys)

Port from terraform-hetzner branch. Adds the Hetzner cc-ci flake host with
all 3 root authorized keys so nixos-rebuild doesn't lock out SSH access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nix/hosts/cc-ci-hetzner/hardware.nix

@@ -0,0 +1,35 @@
+# Hardware configuration for cc-ci on Hetzner Cloud (cpx32: AMD 4 vCPU / 8 GB / x86_64).
+# Generated by nixos-infect from a Debian 12 base image, then committed here.
+#
+# nixos-infect uses GRUB + EFI on Hetzner (not systemd-boot), with a qemu-guest profile
+# because Hetzner Cloud uses KVM virtualisation.
+#
+# IMPORTANT: networking.nix (below) contains the server's static public IP.
+# When provisioning a new server via `terraform apply`, copy the fresh networking.nix
+# from /etc/nixos/networking.nix on the new host and commit it here before rebuilding.
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.loader = {
+    efi.efiSysMountPoint = "/boot/efi";
+    grub = {
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+      device = "nodev";
+    };
+  };
+
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/D978-69EE";
+    fsType = "vfat";
+  };
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.kernelModules = [ "nvme" ];
+
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+}