vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)

- Remove inputs.nix-bitcoin (fort-nix/nix-bitcoin/release) from flake.nix
- Vendor only 6 services actually used by Sovran: bitcoind, electrs,
  lnd (+lndconnect), rtl, btcpayserver, mempool + supporting infra:
  secrets, onion-services/addresses, operator, nodeinfo, security,
  versioning
- All packages now from nixpkgs directly (pkgs.*) — no pinned pkgs
- Keep nix-bitcoin.* option namespace for compatibility
- backups.nix removed: Sovran uses rsnapshot to Second_Drive
  (configuration.nix: hourly/daily to BTCEcoandBackup) — duplicity
  remote backup not needed
- netns-isolation.nix replaced with stub (5 lines): original 365-line
  bridge/iptables/ip-netns broke Caddy/AlbyHub/RTL a year ago and
  is incompatible with nwc-wallets (requires enable=false). Stub
  keeps option valid but warns if enabled.
- Add pkgs/sovran-overlay.nix for gaps only: lndinit + netns-exec stub

modules/core/role-logic.nix

@@ -3,9 +3,9 @@
 {
   config = lib.mkMerge [
 
-    # nix-bitcoin is globally imported by the flake (nixosModules.Sovran_SystemsOS).
-    # This default satisfies nix-bitcoin's generateSecrets assertion so that Desktop
-    # Only systems can evaluate without enabling any Bitcoin services.
+    # Vendored nix-bitcoin is always imported via modules/vendor/nix-bitcoin/modules.nix.
+    # This default satisfies the secrets assertion so Desktop-Only systems evaluate
+    # without enabling any Bitcoin services.
     {
       nix-bitcoin.generateSecrets = lib.mkDefault true;
     }