refactor(1b): RL5 — consolidate Nix code under nix/ (modules->nix/modules, hosts->nix/hosts)

flake.nix/flake.lock STAY at root so the build ref #cc-ci is unchanged; only flake's internal
configuration.nix path updated. Root-relative refs inside moved modules re-based ../X -> ../../X
(secrets/bridge/dashboard); configuration.nix's ../../modules imports unchanged (both dirs under nix/).
Living docs (README, architecture/install/secrets/enroll) + .drone.yml comment updated to nix/...;
append-only history logs left as-is. DECISIONS.md records RL5 + the deferred-coordinated RL6.

Verified on cc-ci: nixos-rebuild build 'path:#cc-ci' -> toplevel 8i3jcad9 (BYTE-IDENTICAL to the
pre-move build — store derivations are content-addressed on file contents, module .nix not in the
runtime closure); scripts/lint.sh -> lint: PASS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -13,10 +13,10 @@ per-recipe test trees, and the docs to enroll a recipe or rebuild the box from s
 ## Layout
 
 ```
-flake.nix              NixOS host(s) + devshell
-hosts/cc-ci/           the cc-ci machine config
-modules/               drone, comment-bridge, swarm, dashboard, secrets (Nix modules)
-secrets/               sops-encrypted infra secrets
+flake.nix              NixOS entry point + devshells (stays at root; build ref #cc-ci)
+nix/hosts/cc-ci/       the cc-ci machine config
+nix/modules/           drone, comment-bridge, swarm, dashboard, secrets (Nix modules)
+secrets/               sops-encrypted infra secrets (cc-ci-secrets submodule)
 bridge/                !testme webhook listener source
 runner/                run_recipe_ci.py + shared pytest harness
 dashboard/             results overview generator
@@ -24,6 +24,9 @@ tests/<recipe>/        per-recipe install/upgrade/backup tests + playwright/
 docs/                  install, enroll-recipe, secrets, architecture, runbook, baseline
 ```
 
+All `.nix` code lives under `nix/`; `flake.nix`/`flake.lock` stay at the repo root so the build
+reference (`nixos-rebuild switch --flake '…#cc-ci'`) is unchanged.
+
 ## Docs
 
 - `docs/install.md` — rebuild the server from scratch (D8)