refactor(attic): move headscale from mx to attic

Headscale is moving off the mx mailserver onto the attic cache host.
The new public URL is https://headscale.hoyer.world.

- Switch from useACMEHost = "hoyer.xyz" (mx wildcard DNS-01) to
  enableACME = true, since attic only has HTTP-01 configured.
- Move headscale port to 8081 to avoid clashing with atticd on 8080.
- Drop the 192.168.178.254 LAN nameserver from dns.nameservers.global,
  which isn't reachable from the Hetzner instance.

Operational steps still required on attic:
- Provision /var/lib/headscale/client_secret
- Migrate the headscale state DB from mx
- Point headscale.hoyer.world DNS at attic
- Update the Nextcloud OIDC client's redirect URI

systems/x86_64-linux/mx/headscale.nix

@@ -1,47 +0,0 @@
-{ config, ... }:
-let
-  domain = "headscale.hoyer.xyz";
-in
-{
-  services = {
-    headscale = {
-      enable = true;
-      address = "0.0.0.0";
-      port = 8080;
-      settings = {
-        server_url = "https://${domain}";
-        dns = {
-          base_domain = "hoyer.tail";
-          nameservers.global = [
-            "192.168.178.254"
-            "1.1.1.1"
-            "1.0.0.1"
-            "2606:4700:4700::1111"
-            "2606:4700:4700::1001"
-          ];
-        };
-        oidc = {
-          allowed_domains = [ "hoyer.xyz" ];
-          client_id = "UgQYtXftYvB9ua4cuyZ9NBvaknQfN76pPnf50pDhqghdb87g9tFcuSMiTLVje3R7";
-          client_secret_path = "/var/lib/headscale/client_secret";
-          issuer = "https://nc.hoyer.xyz";
-        };
-      };
-    };
-
-    nginx.virtualHosts.${domain} = {
-      useACMEHost = "hoyer.xyz";
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${toString config.services.headscale.port}";
-        proxyWebsockets = true;
-        extraConfig = ''
-          proxy_redirect http:// https://;
-          proxy_buffering off;
-        '';
-      };
-    };
-  };
-
-  environment.systemPackages = [ config.services.headscale.package ];
-}