Harden server and add Nix-native CI + self-hosted Gitea Actions

- Add self-hosted Gitea Actions runner module (servers/hetzner/modules/services/gitea.nix)
- Add CI workflow (.gitea/workflows/ci.yml):
  - Flake check (x86_64-linux + aarch64-linux, eval-only)
  - Pre-commit checks (x86_64-linux only)
  - Gitea-native runner (no Docker); Nix from host PATH
  - NIX_CONFIG enables flakes + extra-platforms
- Remove redundant .github/workflows/ci.yml (shadows .gitea)
- Enable deadnix in pre-commit hooks (flake.nix), fix 38 files
- Add statix.toml disabling empty_pattern lint (nixpkgs standard)
- Format whole repo with alejandra (27 files)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Remove aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

.gitea/workflows/ci.yml

@@ -1,3 +1,23 @@
+# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
+#   https://github.com/cachix/install-nix-action
+#   (README: "Flakes CI workflow with nix build and flake check")
+# Every action used here (actions/checkout) is from an official GitHub repo.
+#
+# Adaptations for Gitea Actions:
+#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
+#     explicitly supports self-hosted runners, and this runner's host already provides
+#     Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
+#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
+#   * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
+#     Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
+#     PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
+#     second Nix client that would mismatch the running Lix daemon.
+#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
+#   * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only).
+#     Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs
+#     QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms,
+#     which require a nixos-rebuild switch that hasn't been applied yet.
+
 name: CI
 
 on:
@@ -5,6 +25,9 @@ on:
     branches: [main]
   pull_request:
 
+# Least-privilege by default; jobs opt into what they need.
+permissions: {}
+
 concurrency:
   group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
   cancel-in-progress: true
@@ -13,47 +36,49 @@ defaults:
   run:
     shell: bash
 
+env:
+  NIX_CONFIG: |
+    experimental-features = nix-command flakes
+    extra-platforms = aarch64-linux
+
 jobs:
   flake-check:
+    name: Flake check (${{ matrix.system }})
     runs-on: native
     strategy:
       fail-fast: false
       matrix:
-        system: [x86_64-linux, aarch64-linux]
+        system:
+          - x86_64-linux
+          - aarch64-linux
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Nix
-        run: |
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          mkdir -p "$HOME/.config/nix"
-          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Flake check (${{ matrix.system }})
         run: |
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          export PATH=/run/current-system/sw/bin:$PATH
           nix flake check --no-build --system ${{ matrix.system }}
 
   pre-commit:
+    name: Pre-commit checks (${{ matrix.system }})
     runs-on: native
     strategy:
       fail-fast: false
       matrix:
-        system: [x86_64-linux, aarch64-linux]
+        # aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt +
+        # extra-platforms; system hasn't been rebuilt to apply them yet.
+        system:
+          - x86_64-linux
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Nix
-        run: |
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          mkdir -p "$HOME/.config/nix"
-          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Pre-commit checks (${{ matrix.system }})
         run: |
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          export PATH=/run/current-system/sw/bin:$PATH
           nix build .#checks.${{ matrix.system }}.pre-commit