fix(flake): make Hetzner the canonical cc-ci host target

flake.nix

@@ -31,7 +31,19 @@
       ];
     in
     {
+      # Canonical live host target: the Hetzner cc-ci server.
+      # Use `.#cc-ci` for the current production host.
       nixosConfigurations.cc-ci = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          sops-nix.nixosModules.sops
+          ./nix/hosts/cc-ci-hetzner/configuration.nix
+        ];
+      };
+
+      # Legacy Incus VM host definition retained only for historical comparison and fallback.
+      # Do NOT use this target on the live Hetzner server.
+      nixosConfigurations.cc-ci-incus = nixpkgs.lib.nixosSystem {
         inherit system;
         modules = [
           sops-nix.nixosModules.sops
@@ -39,9 +51,8 @@
         ];
       };
 
-      # Hetzner Cloud host (cpx32, nbg1). Provisions via `terraform/` + nixos-infect.
-      # Used in parallel with cc-ci (Incus) during transition; becomes canonical after cutover.
-      # See terraform/README.md for the full apply + Stage 2 (nixos-rebuild switch) workflow.
+      # Explicit alias for the live Hetzner host. Kept alongside `cc-ci` so the intended host target
+      # remains obvious in recovery/migration workflows.
       nixosConfigurations.cc-ci-hetzner = nixpkgs.lib.nixosSystem {
         inherit system;
         modules = [