Add lxc-tor-relay build type with nyx monitoring

New tor-relay build type (currently lxc-only) running a plain Tor
middle relay via modules/tor/enable-relay.nix, plus nyx for
interactive monitoring over the relay's control socket.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -160,9 +160,10 @@ nixosSystem {
 ```
 
 Platforms: `linode`, `proxmox`, `lxc`. Build types: `minimal`, `nix-cache`,
-`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`. Not every
-combination is built — e.g. `pxe-boot` has no `linode` variant (PXE/DHCP/TFTP
-need LAN L2 adjacency a Linode VPS doesn't have). Treat `flake.nix`'s
+`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`. Not
+every combination is built — e.g. `pxe-boot` has no `linode` variant
+(PXE/DHCP/TFTP need LAN L2 adjacency a Linode VPS doesn't have), and
+`tor-relay` currently only exists as `lxc-tor-relay`. Treat `flake.nix`'s
 `generatedTargets` as the source
 of truth for which hosts exist — `README.md`, `AGENTS.md`,
 `docs/flake-lock-automation.md`, and the CI eval workflows
@@ -190,7 +191,7 @@ removing a host.
   `vzdump` backup-archive metadata this doesn't have), no install step —
   see `docs/auto-installer.md`.
 - `modules/build-types/*.nix` — what a system is for:
-  minimal/server/docker/gui/pxe-boot/nix-cache/tailscale-exit-node.
+  minimal/server/docker/gui/pxe-boot/nix-cache/tailscale-exit-node/tor-relay.
 - `modules/common/configuration.nix` — base NixOS config imported by every
   host: locale, users, nix settings, git.
 - `modules/common/home.nix` / `hosts/nixos/home.nix` — Home Manager config for
@@ -225,7 +226,8 @@ removing a host.
   and `environmentFile`; used by `hosts/server/host.nix` and
   `hosts/nix-cache/host.nix` to avoid duplicating that boilerplate.
 - `modules/tailscale/`, `modules/docker/`, `modules/networking/`,
-  `modules/traefik/`, `modules/services/*` — single-purpose, single-host
+  `modules/traefik/`, `modules/tor/`, `modules/services/*` — single-purpose,
+  single-host
   feature modules (e.g. `docker/enable-service.nix`,
   `services/zfs/enable-service.nix`). Grep `modules/build-types/*.nix` for
   each build type's `imports` list to see which modules apply where.