Refactor flake targets into platform x build-type matrix

Generates all nixosConfigurations from mkTarget(platform, buildType,
hostPath) instead of hand-written per-host blocks, so adding a new
platform or build type is a one-line addition. Per-machine identity
(hostname, hostId, secrets, stateVersion) moves into hosts/<name>/host.nix;
platform-specific config (hardware, boot, networking) into
modules/platforms/*.nix; build-type config (minimal/server/docker/gui/
nix-cache/pxe-boot) into modules/build-types/*.nix.

Old flat targets (nixos, docker, server, nix-cache, nix-minimal, pxe-boot)
are replaced by the 17-target <platform>-<buildtype> matrix; each new
target was verified to evaluate before its old counterpart was removed.
CI workflows and docs/aliases now discover hosts dynamically via
nixosConfigurations attrNames and /etc/flake-target instead of hardcoded
lists, so they can't drift from flake.nix again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -5,17 +5,35 @@ workstation.
 
 ## Hosts
 
-This flake currently defines:
+Targets are named `<platform>-<buildtype>`, generated from two orthogonal
+pieces composed in `flake.nix`:
 
-| Host | Purpose |
+- **Platforms** (what it runs on): `linode`, `proxmox`, `lxc`
+- **Build types** (what it's for): `minimal`, `nix-cache`, `server`, `docker`,
+  `gui`, `pxe-boot`
+
+Not every combination exists — `pxe-boot` has no `linode` variant, since
+PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have. The full
+list:
+
+| Target | Purpose |
 | --- | --- |
-| `nixos` | Main NixOS workstation / Cinnamon desktop |
-| `docker` | Docker host for the main container stack |
-| `server` | Storage, NFS, backup, and monitoring exporter host |
-| `nix-cache` | Local Nix binary cache and remote builder |
-| `nix-minimal` | Minimal NixOS host profile with SSHFS tooling |
-| `pxe-boot` | HTTP/iPXE boot asset host |
-| `linode-minimal` | Minimal NixOS host profile for Linode VPS instances |
+| `linode-minimal` | Minimal NixOS host profile on a Linode VPS (real, deployed) |
+| `proxmox-minimal` | Minimal NixOS host profile on Proxmox (real, deployed — previously the flat `nix-minimal` target) |
+| `lxc-minimal` | Minimal NixOS host profile in a Proxmox LXC container |
+| `linode-nix-cache` / `proxmox-nix-cache` / `lxc-nix-cache` | Local Nix binary cache and remote builder (`proxmox-nix-cache` is the real, deployed one — previously the flat `nix-cache` target) |
+| `linode-server` / `proxmox-server` / `lxc-server` | Storage, NFS, backup, and monitoring exporter host (`proxmox-server` is the real, deployed one — previously the flat `server` target) |
+| `linode-docker` / `proxmox-docker` / `lxc-docker` | Docker host for the main container stack (`proxmox-docker` is the real, deployed one — previously the flat `docker` target) |
+| `linode-gui` / `proxmox-gui` / `lxc-gui` | Cinnamon desktop workstation (`proxmox-gui` is the real, deployed one — previously the flat `nixos` target) |
+| `proxmox-pxe-boot` / `lxc-pxe-boot` | HTTP/iPXE boot asset host (`proxmox-pxe-boot` is the real, deployed one — previously the flat `pxe-boot` target) |
+
+Each buildtype's `hosts/<name>/host.nix` carries the per-machine identity
+(hostname, hostId, per-machine secrets, `system.stateVersion`) that must stay
+fixed regardless of which platform it's built for — see
+`flake-target-refactor-spec.md` for the full rationale. Every deployed host
+stamps its own active target name into `/etc/flake-target` at build time, so
+`nixos-rebuild switch --flake .#$(cat /etc/flake-target)` always picks up the
+right one even after a platform migration changes the flake attribute name.
 
 List hosts with:
 
@@ -27,11 +45,13 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
 
 | Path | Purpose |
 | --- | --- |
-| `flake.nix` | Flake inputs and `nixosConfigurations` outputs |
-| `hosts/<host>/configuration.nix` | Host-specific NixOS configuration |
-| `hosts/nixos/home.nix` | Workstation-specific Home Manager config |
-| `common/` | Shared NixOS, Home Manager, aliases, and hardware config |
-| `modules/nix/` | Binary cache and remote builder client/server modules |
+| `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs |
+| `hosts/<name>/host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` |
+| `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) |
+| `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) |
+| `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache |
+| `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host |
+| `modules/nix-cache/` | Binary cache and remote builder client/server modules |
 | `docs/` | Operational notes for cache, builders, lock updates, and boot services |
 | `scripts/` | Codex setup and validation helpers |