refactor(attic): move headscale from mx to attic

Headscale is moving off the mx mailserver onto the attic cache host.
The new public URL is https://headscale.hoyer.world.

- Switch from useACMEHost = "hoyer.xyz" (mx wildcard DNS-01) to
  enableACME = true, since attic only has HTTP-01 configured.
- Move headscale port to 8081 to avoid clashing with atticd on 8080.
- Drop the 192.168.178.254 LAN nameserver from dns.nameservers.global,
  which isn't reachable from the Hetzner instance.

Operational steps still required on attic:
- Provision /var/lib/headscale/client_secret
- Migrate the headscale state DB from mx
- Point headscale.hoyer.world DNS at attic
- Update the Nextcloud OIDC client's redirect URI

systems/x86_64-linux/attic/default.nix

@@ -6,6 +6,7 @@
   imports = [
     ./hardware-configuration.nix
     ./atticd.nix
+    ./headscale.nix
   ];
 
   metacfg = {

systems/x86_64-linux/attic/headscale.nix

@@ -1,19 +1,18 @@
 { config, ... }:
 let
-  domain = "headscale.hoyer.xyz";
+  domain = "headscale.hoyer.world";
 in
 {
   services = {
     headscale = {
       enable = true;
       address = "0.0.0.0";
-      port = 8080;
+      port = 8081;
       settings = {
         server_url = "https://${domain}";
         dns = {
           base_domain = "hoyer.tail";
           nameservers.global = [
-            "192.168.178.254"
             "1.1.1.1"
             "1.0.0.1"
             "2606:4700:4700::1111"
@@ -30,8 +29,8 @@ in
     };
 
     nginx.virtualHosts.${domain} = {
-      useACMEHost = "hoyer.xyz";
       forceSSL = true;
+      enableACME = true;
       locations."/" = {
         proxyPass = "http://localhost:${toString config.services.headscale.port}";
         proxyWebsockets = true;

systems/x86_64-linux/mx/default.nix

@@ -13,7 +13,6 @@
     ./disk-check.nix
     ./forgejo.nix
     ./hardware-configuration.nix
-    ./headscale.nix
     ./kicker.nix
     ./mailserver.nix
     ./network.nix