Refactor flake targets into platform x build-type matrix

Generates all nixosConfigurations from mkTarget(platform, buildType,
hostPath) instead of hand-written per-host blocks, so adding a new
platform or build type is a one-line addition. Per-machine identity
(hostname, hostId, secrets, stateVersion) moves into hosts/<name>/host.nix;
platform-specific config (hardware, boot, networking) into
modules/platforms/*.nix; build-type config (minimal/server/docker/gui/
nix-cache/pxe-boot) into modules/build-types/*.nix.

Old flat targets (nixos, docker, server, nix-cache, nix-minimal, pxe-boot)
are replaced by the 17-target <platform>-<buildtype> matrix; each new
target was verified to evaluate before its old counterpart was removed.
CI workflows and docs/aliases now discover hosts dynamically via
nixosConfigurations attrNames and /etc/flake-target instead of hardcoded
lists, so they can't drift from flake.nix again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/flake-lock-automation.md

@@ -8,14 +8,10 @@ and to verify that declared NixOS hosts still evaluate after dependency updates.
 - A scheduled workflow runs `nix flake update` once per week.
 - On GitHub, any resulting `flake.lock` change is proposed through a pull request.
 - On Gitea, the workflow can commit and push `flake.lock` directly when PR automation is not configured.
-- A separate CI workflow evaluates every configured host before merge:
-  - `nixos`
-  - `docker`
-  - `server`
-  - `nix-cache`
-  - `nix-minimal`
-  - `pxe-boot`
-  - `linode-minimal`
+- A separate CI workflow evaluates every configured host before merge, listed
+  dynamically via `nix eval --json .#nixosConfigurations --apply builtins.attrNames`
+  rather than hand-enumerated, so it can't drift as `<platform>-<buildtype>`
+  targets are added or removed. See `README.md` for the current target list.
 
 ## Why hosts should stop using `--upgrade-all`
 
@@ -24,9 +20,15 @@ and to verify that declared NixOS hosts still evaluate after dependency updates.
 Recommended rebuild command:
 
 ```bash
-sudo nixos-rebuild switch --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
+sudo nixos-rebuild switch --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
 ```
 
+Flake attribute names are `<platform>-<buildtype>` (e.g. `proxmox-docker`)
+and no longer match `hostname`, since a host's hostname stays fixed while
+the platform backing it can change. Each `nixosConfiguration` stamps its own
+active target name into `/etc/flake-target` at build time, which is what the
+command above reads.
+
 Using the committed lock file keeps all hosts aligned and makes updates auditable through CI and code review.
 
 Codex and automated review sessions must not run rebuilds. Limit checks to