refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

src/system/machines/desktop/system.nix

@@ -1,148 +0,0 @@
-{ pkgs, lib, config, ... }:
-
-let
-  gpgEnabled = lib.any
-    (user: user.modules.user.security.gpg.enable or false)
-    (lib.attrValues config.home-manager.users);
-
-in
-{ system.stateVersion = "23.11";
-
-  users.users = {
-    ${config.user.name} = {
-      isNormalUser = true;
-      extraGroups = config.user.groups
-        ++ [ "video" "audio" "kvm" "libvirtd" "dialout" ];
-      openssh.authorizedKeys.keys = [ "${config.user.keys.ssh.graphone}" ];
-    };
-  };
-
-  nix = {
-    channel.enable = false;
-    package = pkgs.nixVersions.stable;
-    extraOptions = ''
-      experimental-features = nix-command flakes
-      keep-going = true
-    '';
-    settings = {
-      auto-optimise-store = true;
-      trusted-users = [ "${config.user.name}" ];
-      substitute = true;
-      max-jobs = "auto";
-    };
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-  };
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-      configurationLimit = 5;
-      #memtest86.enable = true;
-    };
-
-    efi = {
-      canTouchEfiVariables = true;
-    };
-    #timeout = null;
-  };
-
-  environment = {
-    systemPackages = with pkgs; [
-      vim
-      git
-      usbutils
-    ];
-    pathsToLink = [
-      "/share/applications"
-      "/share/xdg-desktop-portal"
-    ];
-  };
-
-  fonts.packages = with pkgs; [
-    nerd-fonts.terminess-ttf
-  ];
-
-  security = {
-    sudo = {
-      wheelNeedsPassword = false;
-      execWheelOnly = true;
-    };
-    polkit.enable = true;
-  };
-
-  time = {
-    timeZone = "America/New_York";
-    hardwareClockInLocalTime = true;
-  };
-
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  console = {
-    font = "Lat2-Terminus16";
-    useXkbConfig = true;
-  };
-
-  networking = {
-    hostName = "desktop";
-    useDHCP = lib.mkDefault true;
-    networkmanager.enable = true;
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 22 80 443 ];
-    };
-  };
-
-  services.dnsmasq = {
-    enable = true;
-    settings = {
-      # Explicit subdomains -> local server
-      address = [
-        "/git.ramos.codes/192.168.0.154"
-        "/ln.ramos.codes/192.168.0.154"
-        "/photos.ramos.codes/192.168.0.154"
-        "/test.ramos.codes/192.168.0.154"
-        "/electrum.ramos.codes/192.168.0.154"
-        "/immich.ramos.codes/192.168.0.154"
-        "/forgejo.ramos.codes/192.168.0.154"
-        "/frigate.ramos.codes/192.168.0.154"
-      ];
-      server = [ "192.168.0.1" ];
-    };
-  };
-
-  services = {
-    pcscd.enable = gpgEnabled;
-    timesyncd = lib.mkDefault {
-      enable = true;
-      servers = [
-        "0.pool.ntp.org"
-        "1.pool.ntp.org"
-        "2.pool.ntp.org"
-        "3.pool.ntp.org"
-      ];
-    };
-    pipewire = {
-      enable = true;
-      audio.enable = true;
-
-      wireplumber.enable = true;
-
-      pulse.enable = true;
-      jack.enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-    };
-    openssh = {
-      enable = true;
-      startWhenNeeded = false;
-      settings = {
-        X11Forwarding = false;
-        PasswordAuthentication = false;
-      };
-    };
-  };
-}