Resolve all statix and nixpkgs-fmt warnings repo-wide

Zero W20 (repeated attribute keys), W10 (empty { ... }: variadic
pattern, use _: instead), and W04 (a = x.a instead of inherit)
warnings remain anywhere in the tree, and nixpkgs-fmt --check is
clean on all 46 .nix files.

Repeated-key merges go as deep as statix actually flags per file
(e.g. boot.loader.* nested under boot.loader = { ... } once the
outer boot.* merge exposed it as its own repeat) — every merge is a
pure attribute-path restructuring with no value changes, verified by
comparing config.system.build.toplevel.drvPath before/after for a
representative host per changed module plus a full 19-host + 4-package
eval sweep.

One indentation slip caught and fixed during this pass: nesting
modules/installer/common.nix's environment.etc."auto-install.sh".text
under an environment = { ... } block initially normalized the
script's shebang/set line indentation, which actually changes the
rendered file (Nix's '' string dedent treats it as real content, not
cosmetic whitespace) — reproduced the original's exact indentation
and reverified the rendered script is byte-identical to before.

modules/services/zfs/auto-mount-volumes.nix picked up formatting too;
worth noting it isn't imported by anything in this flake at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/nix-cache/server.nix

@@ -9,19 +9,23 @@
   #   sudo chmod 0600 /etc/nix/cache-priv.pem
   #   sudo chmod 0644 /etc/nix/cache-pub.pem
   #   cat /etc/nix/cache-pub.pem
-  services.nix-serve = {
-    enable = true;
-    secretKeyFile = "/etc/nix/cache-priv.pem";
-  };
+  services = {
+    nix-serve = {
+      enable = true;
+      secretKeyFile = "/etc/nix/cache-priv.pem";
+    };
 
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts.${vars.nixCacheHost} = {
-      locations."/" = {
-        proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+    nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts.${vars.nixCacheHost} = {
+        locations."/" = {
+          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+        };
       };
     };
+
+    openssh.enable = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 ];
@@ -40,8 +44,6 @@
     openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
   };
 
-  services.openssh.enable = true;
-
   nix.settings = {
     trusted-users = [ "root" vars.remoteBuilderUser ];
     experimental-features = [ "nix-command" "flakes" ];