refactor(attic): move headscale from mx to attic

Headscale is moving off the mx mailserver onto the attic cache host.
The new public URL is https://headscale.hoyer.world.

- Switch from useACMEHost = "hoyer.xyz" (mx wildcard DNS-01) to
  enableACME = true, since attic only has HTTP-01 configured.
- Move headscale port to 8081 to avoid clashing with atticd on 8080.
- Drop the 192.168.178.254 LAN nameserver from dns.nameservers.global,
  which isn't reachable from the Hetzner instance.

Operational steps still required on attic:
- Provision /var/lib/headscale/client_secret
- Migrate the headscale state DB from mx
- Point headscale.hoyer.world DNS at attic
- Update the Nextcloud OIDC client's redirect URI

systems/x86_64-linux/attic/headscale.nix

@@ -0,0 +1,46 @@
+{ config, ... }:
+let
+  domain = "headscale.hoyer.world";
+in
+{
+  services = {
+    headscale = {
+      enable = true;
+      address = "0.0.0.0";
+      port = 8081;
+      settings = {
+        server_url = "https://${domain}";
+        dns = {
+          base_domain = "hoyer.tail";
+          nameservers.global = [
+            "1.1.1.1"
+            "1.0.0.1"
+            "2606:4700:4700::1111"
+            "2606:4700:4700::1001"
+          ];
+        };
+        oidc = {
+          allowed_domains = [ "hoyer.xyz" ];
+          client_id = "UgQYtXftYvB9ua4cuyZ9NBvaknQfN76pPnf50pDhqghdb87g9tFcuSMiTLVje3R7";
+          client_secret_path = "/var/lib/headscale/client_secret";
+          issuer = "https://nc.hoyer.xyz";
+        };
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.headscale.port}";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_redirect http:// https://;
+          proxy_buffering off;
+        '';
+      };
+    };
+  };
+
+  environment.systemPackages = [ config.services.headscale.package ];
+}