refactor(1b): RL5 — consolidate Nix code under nix/ (modules->nix/modules, hosts->nix/hosts)

flake.nix/flake.lock STAY at root so the build ref #cc-ci is unchanged; only flake's internal
configuration.nix path updated. Root-relative refs inside moved modules re-based ../X -> ../../X
(secrets/bridge/dashboard); configuration.nix's ../../modules imports unchanged (both dirs under nix/).
Living docs (README, architecture/install/secrets/enroll) + .drone.yml comment updated to nix/...;
append-only history logs left as-is. DECISIONS.md records RL5 + the deferred-coordinated RL6.

Verified on cc-ci: nixos-rebuild build 'path:#cc-ci' -> toplevel 8i3jcad9 (BYTE-IDENTICAL to the
pre-move build — store derivations are content-addressed on file contents, module .nix not in the
runtime closure); scripts/lint.sh -> lint: PASS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nix/modules/packages.nix

@@ -0,0 +1,25 @@
+# Project package overlay. `abra` (the Co-op Cloud CLI) is exposed as `pkgs.abra` so every
+# module (systemPackages, the proxy/drone reconcile oneshots) can use the same pinned build.
+_:
+{
+  nixpkgs.overlays = [
+    (_: prev: {
+      abra = prev.stdenv.mkDerivation rec {
+        pname = "abra";
+        version = "0.13.0-beta";
+        src = prev.fetchurl {
+          url = "https://git.coopcloud.tech/toolshed/abra/releases/download/${version}/abra_${version}_linux_amd64.tar.gz";
+          sha256 = "12csk6wp1pk9cspzqfl4a6h5jdz8p055sf0ggxw9k7ljhpd5qvc6";
+        };
+        sourceRoot = ".";
+        nativeBuildInputs = [ prev.autoPatchelfHook ];
+        buildInputs = [ prev.stdenv.cc.cc.lib ];
+        installPhase = ''
+          runHook preInstall
+          install -Dm755 abra "$out/bin/abra"
+          runHook postInstall
+        '';
+      };
+    })
+  ];
+}