refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

justfile

@@ -1,5 +1,5 @@
 SYSTEM := "$(echo $HOSTNAME)"
-VALID_SYSTEMS := "desktop workstation server wsl vm laptop"
+VALID_SYSTEMS := "desktop server wsl"
 
 # Print this list
 default:
@@ -10,7 +10,7 @@ default:
 _validate SYSTEM:
   #!/usr/bin/env bash
   case "{{SYSTEM}}" in
-    desktop|workstation|server|wsl|vm|laptop) ;;
+    desktop|server|wsl) ;;
     *) echo "Error: Unknown system '{{SYSTEM}}'. Use one of: {{VALID_SYSTEMS}}"; exit 1 ;;
   esac
 
@@ -105,7 +105,7 @@ partition SYSTEM:
   #!/usr/bin/env bash
   set -euo pipefail
 
-  DISKO_CONFIG="./src/system/machines/{{SYSTEM}}/modules/disko/default.nix"
+  DISKO_CONFIG="./system/machines/{{SYSTEM}}/modules/disko/default.nix"
 
   if [[ ! -f "$DISKO_CONFIG" ]]; then
     echo "Error: No disko config for '{{SYSTEM}}'"
@@ -172,7 +172,7 @@ install SYSTEM:
   #!/usr/bin/env bash
   set -euo pipefail
 
-  DISKO_CONFIG="./src/system/machines/{{SYSTEM}}/modules/disko/default.nix"
+  DISKO_CONFIG="./system/machines/{{SYSTEM}}/modules/disko/default.nix"
 
   if [[ ! -f "$DISKO_CONFIG" ]]; then
     echo "Error: No disko config for '{{SYSTEM}}'"