Restructure flake into per-host modules

Move host-specific files under hosts/<name>/ so a second machine can be
added without forking the repo. Split system/users.nix and
system/display-manager.nix into per-option subfolders, separate the
home-manager packages list into a shared base and a personal bundle,
extract networking.hostName out of the shared networking module, and
inline the git identity into the per-host home.nix. Add .gitignore
guardrails to keep secrets out.

.gitignore

@@ -1,2 +1,10 @@
 .claude
 docs/
+
+# secret guardrails — keep credentials out of the repo
+secrets/
+*.age
+*.key
+*.pem
+.env
+.env.*