refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

src/system/modules/immich/default.nix

@@ -1,57 +0,0 @@
-{ pkgs, lib, config, ... }:
-
-with lib;
-let
-  cfg = config.modules.system.immich;
-  nginx = config.modules.system.nginx;
-  domain = "ramos.codes";
-  port = 2283;
-
-in
-{
-  options.modules.system.immich = {
-    enable = mkEnableOption "Immich Photo Server";
-  };
-
-  config = mkIf cfg.enable {
-    # Bind mount from /data
-    systemd.tmpfiles.rules = [
-      "d /data/immich 0750 immich immich -"
-      "d /data/postgresql 0750 postgres postgres -"
-    ];
-
-    fileSystems."/var/lib/immich" = {
-      device = "/data/immich";
-      fsType = "none";
-      options = [ "bind" ];
-    };
-
-    fileSystems."/var/lib/postgresql" = {
-      device = "/data/postgresql";
-      fsType = "none";
-      options = [ "bind" ];
-    };
-
-    services.immich = {
-      enable = true;
-      port = port;
-      host = "127.0.0.1";
-      mediaLocation = "/var/lib/immich";
-      machine-learning.enable = false;
-    };
-
-    modules.system.backup.paths = [
-      "/var/lib/immich"
-      "/var/lib/postgresql"
-    ];
-
-    services.nginx.virtualHosts."photos.${domain}" = mkIf nginx.enable {
-      useACMEHost = domain;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString port}";
-        proxyWebsockets = true;
-      };
-    };
-  };
-}