Clean up and centralize NixOS host configuration

[DeclanRiedel]

What changed

• carries forward the existing OpenCode and workstation cleanup
• adds memory safeguards and focused Codex updates for vostro only
• defines hosts from a structured inventory in flake.nix
• passes host, system, user, and home metadata through specialArgs
• removes hard-coded host/user paths from shared modules
• explicitly aligns Nixvim with the main Nixpkgs source, eliminating its evaluation warning
• removes the GitHub Actions flake-check workflow

Architecture

The memory and auto-update modules are now host-scoped instead of shared. A full common/desktop/server/wsl profile split and template extraction are intentionally deferred.

The Codex auto-update timer remains enabled for vostro. It still mutates flake.lock in the live checkout; replacing it with automated dependency PRs is deferred until that workflow is agreed upon.

Validation

• targeted nixpkgs-fmt --check
• targeted deadnix --fail
• statix check across the flake, modules, Home Manager, and hosts
• nix flake check --no-build (all three NixOS configurations)