vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)

- Remove inputs.nix-bitcoin (fort-nix/nix-bitcoin/release) from flake.nix
- Vendor only 6 services actually used by Sovran: bitcoind, electrs,
  lnd (+lndconnect), rtl, btcpayserver, mempool + supporting infra:
  secrets, onion-services/addresses, operator, nodeinfo, security,
  versioning
- All packages now from nixpkgs directly (pkgs.*) — no pinned pkgs
- Keep nix-bitcoin.* option namespace for compatibility
- backups.nix removed: Sovran uses rsnapshot to Second_Drive
  (configuration.nix: hourly/daily to BTCEcoandBackup) — duplicity
  remote backup not needed
- netns-isolation.nix replaced with stub (5 lines): original 365-line
  bridge/iptables/ip-netns broke Caddy/AlbyHub/RTL a year ago and
  is incompatible with nwc-wallets (requires enable=false). Stub
  keeps option valid but warns if enabled.
- Add pkgs/sovran-overlay.nix for gaps only: lndinit + netns-exec stub

modules/vendor/nix-bitcoin/modules.nix

@@ -0,0 +1,27 @@
+# Vendored nix-bitcoin — MINIMAL subset used by Sovran_SystemsOS
+# Original source: https://github.com/fort-nix/nix-bitcoin
+# Only services actually used by Sovran are kept (6 services vs 20+ upstream)
+# - backups.nix removed: Sovran uses rsnapshot to Second_Drive (configuration.nix)
+# - netns-isolation.nix is now a stub (requires false for nwc-wallets)
+{
+  imports = [
+    ./nix-bitcoin.nix
+    ./secrets/secrets.nix
+    ./operator.nix
+    ./bitcoind.nix
+    ./electrs.nix
+    ./lnd.nix
+    ./lndconnect.nix
+    ./rtl.nix
+    ./btcpayserver.nix
+    ./mempool.nix
+    ./security.nix
+    ./onion-addresses.nix
+    ./onion-services.nix
+    ./netns-isolation.nix
+    ./nodeinfo.nix
+    ./versioning.nix
+  ];
+
+  disabledModules = [ "services/networking/bitcoind.nix" ];
+}