Fix LXC deployment path and clean up remaining eval warnings

LXC hosts (device busy fix):

modules/platforms/lxc.nix now imports nixpkgs' own
virtualisation/proxmox-lxc.nix, giving every lxc-* host a real
config.system.build.tarball output — a directly `pct restore`-able
Proxmox container image. This is the actual bug fix behind the
"cannot remove real root directory: device busy or in use" error:
lxc-* targets were only reachable through nixos-install, which
bind-mounts / onto /mnt for containers (no raw disk to partition)
and then correctly refuses to modify the filesystem it's currently
running on. auto-install.sh's menu now excludes lxc-* targets
entirely (they deploy via nix build + pct restore instead, see
docs/auto-installer.md) — and, on the same reasoning, also excludes
`installer`/`proxmox-lxc`, which are the installer image's own flake
targets, not deployable hosts.

manageHostName = true keeps host.nix's declared hostnames (upstream's
default would let Proxmox's ambient container config win instead);
privileged = false matches how these containers are actually created.

Eval warnings, now zero across all 19 nixosConfigurations + 4 packages:

- Multiple password options (root/nixos in the installer): nixpkgs'
  own installer profile sets initialHashedPassword = "" for
  passwordless login, conflicting with our explicit hashedPassword.
  Force-nulled the upstream option rather than adopting passwordless
  login, since this image now also boots over LAN PXE with
  PasswordAuthentication enabled.
- boot.zfs.forceImportRoot default value: set explicitly to false
  (matching the two places that already did) in
  modules/common/configuration.nix and modules/installer/common.nix,
  covering every host and the installer alike.
- Deprecated pkgs.system in modules/build-types/gui.nix: switched to
  pkgs.stdenv.hostPlatform.system.

All confirmed non-behavioral where it matters: unrelated hosts'
drvPaths are byte-identical to their pre-existing baselines throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/installer/common.nix

@@ -7,6 +7,12 @@
 
   networking.useDHCP = lib.mkDefault true;
 
+  # Recommended over the true default (bypasses ZFS's own import safeguards)
+  # per the option's own docs. This installer environment has no ZFS pools
+  # of its own to import, so this is a no-op here — just silences the
+  # eval-time warning, matching modules/common/configuration.nix.
+  boot.zfs.forceImportRoot = false;
+
   time.timeZone = vars.timeZone;
 
   # Without this, the installer only ever sees cache.nixos.org, which
@@ -50,11 +56,26 @@
         export FLAKE_BASE_URL="git+https://${vars.lanDomain}/beatzaplenty/nixos.git"
 
         echo "Fetching available NixOS hosts from flake..."
+        # Two categories deliberately excluded from the menu:
+        #   lxc-*                 — these build a config.system.build.tarball
+        #                           meant for `pct restore` on Proxmox
+        #                           directly, not an install. Running
+        #                           nixos-install against one here would
+        #                           bind-mount / onto /mnt and then refuse to
+        #                           touch the filesystem it's currently
+        #                           running on — see docs/auto-installer.md.
+        #   installer/proxmox-lxc — these *are* the installer image's own
+        #                           flake targets, not deployable hosts;
+        #                           "installing" one means nixos-install-ing
+        #                           a copy of the installer into itself.
         mapfile -t options < <(
           nix eval --json --no-use-registries --no-accept-flake-config --extra-experimental-features "flakes nix-command" \
             "''${FLAKE_BASE_URL}#nixosConfigurations" \
             --apply builtins.attrNames \
-          | jq -r '.[]'
+          | jq -r '.[]
+              | select(startswith("lxc-") | not)
+              | select(. != "installer")
+              | select(. != "proxmox-lxc")'
         )
 
         if [[ ''${#options[@]} -eq 0 ]]; then
@@ -62,6 +83,10 @@
           exit 1
         fi
 
+        echo "Note: lxc-* targets aren't installed this way — build them with"
+        echo "  nix build .#nixosConfigurations.<name>.config.system.build.tarball"
+        echo "and 'pct restore' the result on Proxmox directly. See docs/auto-installer.md."
+
         echo "Choose the flake profile to install:"
         select choice in "''${options[@]}"; do
           if [[ -n "$choice" ]]; then
@@ -190,9 +215,18 @@
     PasswordAuthentication = true;
   };
 
+  # nixpkgs' own installer profile (profiles/installation-device.nix, pulled
+  # in via installation-cd-minimal.nix) sets initialHashedPassword = "" for
+  # both users — its own passwordless-login convention for install media.
+  # That's a second, non-null password option alongside our hashedPassword
+  # below, which NixOS warns about as ambiguous precedence. Force it null
+  # rather than adopting passwordless login: this image now also boots over
+  # LAN PXE with PasswordAuthentication enabled, so passwordless root SSH
+  # would be reachable by anyone on the LAN, not just local console.
   users.users.root = {
     hashedPassword =
       "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
+    initialHashedPassword = lib.mkForce null;
   };
 
   users.users.${vars.primaryUser} = {
@@ -206,6 +240,7 @@
 
     hashedPassword =
       "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
+    initialHashedPassword = lib.mkForce null;
 
     openssh.authorizedKeys.keys = [
       vars.adminSshKey