refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

system/machines/server/modules/nginx/default.nix

@@ -0,0 +1,76 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.system.nginx;
+  domain = "ramos.codes";
+
+in
+{
+  options.modules.system.nginx = {
+    enable = mkEnableOption "Nginx Reverse Proxy";
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    systemd.services.nginx.serviceConfig.LimitNOFILE = 65536;
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = config.user.email;
+
+      certs."${domain}" = {
+        domain = "*.${domain}";
+        dnsProvider = "namecheap";
+        environmentFile = "/var/lib/acme/namecheap.env";
+        group = "nginx";
+      };
+    };
+
+    services.sslh = {
+      enable = true;
+      listenAddresses = [ "0.0.0.0" ];
+      port = 443;
+      settings = {
+        protocols = [
+          { name = "ssh"; host = "127.0.0.1"; port = "22"; }
+          { name = "tls"; host = "127.0.0.1"; port = "4443"; }
+        ];
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      eventsConfig = "worker_connections 4096;";
+      defaultSSLListenPort = 4443;
+
+      # Catch-all default - friendly error for unknown subdomains
+      virtualHosts."_" = {
+        default = true;
+        useACMEHost = domain;
+        forceSSL = true;
+        locations."/" = {
+          return = "404 'Not Found: This subdomain does not exist.'";
+          extraConfig = ''
+            add_header Content-Type text/plain;
+          '';
+        };
+      };
+
+      virtualHosts."test.${domain}" = {
+        useACMEHost = domain;
+        forceSSL = true;
+        locations."/" = {
+          return = "200 'nginx is working'";
+          extraConfig = ''
+            add_header Content-Type text/plain;
+          '';
+        };
+      };
+    };
+  };
+}