site-config: dedupe cross-host values, fix stale dark-reader urls, drop desktop 1g hugepages

new site-config.nix holds values previously duplicated across hosts:
  domain, old_domain, contact_email, timezone, binary_cache (url + pubkey),
  dns_servers, lan (cidr + gateway), hosts.{muffin,yarn} (ip/alias/ssh_host_key),
  ssh_keys.{laptop,desktop,ci_deploy}.

threaded through specialArgs on all three hosts + home-manager extraSpecialArgs +
homeConfigurations.primary + serverLib. service-configs.nix now takes
{ site_config } as a function arg and drops its https namespace; per-service
domains (gitea/matrix/ntfy/mollysocket/livekit/firefox-sync/grafana) are
derived from site_config.domain. ~15 service files and 6 vm tests migrated.

breakage fixes rolled in:
 - home/progs/zen/dark-reader.nix: 5 stale *.gardling.com entries in
   disabledFor rewritten to *.sigkill.computer (caddy 301s the old names so
   these never fired and the new sigkill urls were getting dark-reader applied)
 - modules/desktop-common.nix: drop unused hugepagesz=1G/hugepages=3
   kernelParams (no consumer on mreow or yarn; xmrig on muffin still reserves
   its own via services/monero/xmrig.nix)

verification: muffin toplevel is bit-identical to pre-refactor baseline.
mreow/yarn toplevels differ only in boot.json kernelParams + darkreader
storage.js (nix-diff verified). deployGuardTest and fail2banVaultwardenTest
(latter exercises site_config.domain via bitwarden.nix) pass.

hosts/yarn/default.nix

@@ -4,6 +4,7 @@
   lib,
   username,
   inputs,
+  site_config,
   ...
 }:
 {
@@ -43,8 +44,8 @@
     };
     ipv4 = {
       method = "manual";
-      address1 = "192.168.1.223/24,192.168.1.1";
-      dns = "1.1.1.1;9.9.9.9;";
+      address1 = "${site_config.hosts.yarn.ip}/24,${site_config.lan.gateway}";
+      dns = lib.concatMapStrings (n: "${n};") site_config.dns_servers;
     };
     ipv6.method = "disabled";
   };
@@ -59,12 +60,12 @@
   };
 
   users.users.${username}.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
+    site_config.ssh_keys.laptop
   ];
 
   users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5ZYN6idL/w/mUIfPOH1i+Q/SQXuzAMQUEuWpipx1Pc ci-deploy@muffin"
+    site_config.ssh_keys.laptop
+    site_config.ssh_keys.ci_deploy
   ];
 
   programs.steam = {
@@ -99,7 +100,7 @@
           ]
         }
 
-        STORE_PATH=$(curl -sf --max-time 30 "https://nix-cache.sigkill.computer/deploy/yarn" || true)
+        STORE_PATH=$(curl -sf --max-time 30 "${site_config.binary_cache.url}/deploy/yarn" || true)
         if [ -z "$STORE_PATH" ]; then
           echo "server unreachable"
           exit 1
@@ -152,7 +153,7 @@
     (
       final: prev:
       let
-        deploy-url = "https://nix-cache.sigkill.computer/deploy/yarn";
+        deploy-url = "${site_config.binary_cache.url}/deploy/yarn";
 
         steamos-update-script = final.writeShellScript "steamos-update" ''
           export PATH=${