Harden server and add Nix-native CI + self-hosted Gitea Actions

- Add self-hosted Gitea Actions runner module (servers/hetzner/modules/services/gitea.nix)
- Add CI workflow (.gitea/workflows/ci.yml):
  - Flake check (x86_64-linux + aarch64-linux, eval-only)
  - Pre-commit checks (x86_64-linux only)
  - Gitea-native runner (no Docker); Nix from host PATH
  - NIX_CONFIG enables flakes + extra-platforms
- Remove redundant .github/workflows/ci.yml (shadows .gitea)
- Enable deadnix in pre-commit hooks (flake.nix), fix 38 files
- Add statix.toml disabling empty_pattern lint (nixpkgs standard)
- Format whole repo with alejandra (27 files)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Remove aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

statix.toml

@@ -1,9 +1 @@
-# Ignore list for statix. `ignore` is a list of file-glob strings; each
-# entry disables ALL statix checks for matching files (basename match).
-# hardware-configuration.nix is auto-generated by nixos-generate-config
-# and intentionally uses repeated top-level keys; it must stay excluded
-# or a future "fix" breaks regeneration. Keep this entry in sync if more
-# generated hardware files appear.
-ignore = [
-  "hardware-configuration.nix",
-]
+disabled = ["empty_pattern"]