vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)

- Remove inputs.nix-bitcoin (fort-nix/nix-bitcoin/release) from flake.nix
- Vendor only 6 services actually used by Sovran: bitcoind, electrs,
  lnd (+lndconnect), rtl, btcpayserver, mempool + supporting infra:
  secrets, onion-services/addresses, operator, nodeinfo, security,
  versioning
- All packages now from nixpkgs directly (pkgs.*) — no pinned pkgs
- Keep nix-bitcoin.* option namespace for compatibility
- backups.nix removed: Sovran uses rsnapshot to Second_Drive
  (configuration.nix: hourly/daily to BTCEcoandBackup) — duplicity
  remote backup not needed
- netns-isolation.nix replaced with stub (5 lines): original 365-line
  bridge/iptables/ip-netns broke Caddy/AlbyHub/RTL a year ago and
  is incompatible with nwc-wallets (requires enable=false). Stub
  keeps option valid but warns if enabled.
- Add pkgs/sovran-overlay.nix for gaps only: lndinit + netns-exec stub

modules/vendor/nix-bitcoin/netns-isolation.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+with lib;
+{
+  options.nix-bitcoin.netns-isolation = {
+    enable = mkEnableOption "netns isolation (stub — disabled in Sovran_SystemsOS)";
+  };
+  # No config when enabled — isolation is intentionally not implemented.
+  # Sovran requires enable = false (see modules/nwc-wallets.nix assertion).
+  # The original nix-bitcoin implementation (365 lines, bridge nb-br, iptables,
+  # ip netns, 169.254.x.x) broke Caddy/AlbyHub/RTL and is not needed for
+  # desktop/server roles. Keep stub so `nix-bitcoin.netns-isolation.enable`
+  # remains a valid option.
+  config = mkIf config.nix-bitcoin.netns-isolation.enable {
+    warnings = [ "nix-bitcoin.netns-isolation.enable is a stub in vendored Sovran and does nothing. Set it to false." ];
+  };
+}