- gateway: replace konnektor/api/auth/mailpit vhosts with
music.home.lindenfelser.de -> 10.202.82.195:80, LAN-only (403 otherwise)
- common: enable system.autoUpgrade, pulling config from Gitea main and
overriding nixpkgs to the nixos-25.11 tip for weekly package refresh;
reboot allowed in a 04:00-06:00 window
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
danlin