Harden server and add Nix-native CI + self-hosted Gitea Actions

- Add self-hosted Gitea Actions runner module (servers/hetzner/modules/services/gitea.nix)
- Add CI workflow (.gitea/workflows/ci.yml):
  - Flake check (x86_64-linux + aarch64-linux, eval-only)
  - Pre-commit checks (x86_64-linux only)
  - Gitea-native runner (no Docker); Nix from host PATH
  - NIX_CONFIG enables flakes + extra-platforms
- Remove redundant .github/workflows/ci.yml (shadows .gitea)
- Enable deadnix in pre-commit hooks (flake.nix), fix 38 files
- Add statix.toml disabling empty_pattern lint (nixpkgs standard)
- Format whole repo with alejandra (27 files)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Remove aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

servers/hetzner/modules/services/gitea.nix

@@ -1,7 +1,5 @@
 {
-  config,
   pkgs,
-  lib,
   unstablePkgs,
   ...
 }: {
@@ -98,8 +96,10 @@
   '';
 
   # --- Gitea Actions self-hosted CI runner ---
-  # Jobs install their own Nix inside the runner (official installer,
-  # --no-daemon) so no system Nix daemon / nix-users group is needed.
+  # The native runner only exposes `hostPackages` on PATH (see the list above),
+  # which intentionally omits Nix. CI steps export the host's system Nix
+  # (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a
+  # second Nix client, so the running Lix daemon is used directly.
   # aarch64 builds run under QEMU user-emulation via boot.binfmt below.
   boot.binfmt.emulatedSystems = ["aarch64-linux"];
 }