vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)

- Remove inputs.nix-bitcoin (fort-nix/nix-bitcoin/release) from flake.nix
- Vendor only 6 services actually used by Sovran: bitcoind, electrs,
  lnd (+lndconnect), rtl, btcpayserver, mempool + supporting infra:
  secrets, onion-services/addresses, operator, nodeinfo, security,
  versioning
- All packages now from nixpkgs directly (pkgs.*) — no pinned pkgs
- Keep nix-bitcoin.* option namespace for compatibility
- backups.nix removed: Sovran uses rsnapshot to Second_Drive
  (configuration.nix: hourly/daily to BTCEcoandBackup) — duplicity
  remote backup not needed
- netns-isolation.nix replaced with stub (5 lines): original 365-line
  bridge/iptables/ip-netns broke Caddy/AlbyHub/RTL a year ago and
  is incompatible with nwc-wallets (requires enable=false). Stub
  keeps option valid but warns if enabled.
- Add pkgs/sovran-overlay.nix for gaps only: lndinit + netns-exec stub

modules/vendor/nix-bitcoin/secure-node.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services;
+  nbLib = config.nix-bitcoin.lib;
+  operatorName = config.nix-bitcoin.operator.name;
+in {
+  imports = [
+    ../modules.nix
+    ./enable-tor.nix
+  ];
+
+  options = {
+    # Used by ../versioning.nix
+    nix-bitcoin.secure-node-preset-enabled = {};
+  };
+
+  config =  {
+    networking.firewall.enable = true;
+
+    nix-bitcoin.security.dbusHideProcessInformation = true;
+
+    # Use doas instead of sudo
+    security.doas.enable = true;
+    security.sudo.enable = false;
+    environment.shellAliases.sudo = "doas";
+
+    environment.systemPackages = with pkgs; [
+      jq
+    ];
+
+    # Add a SSH onion service
+    services.tor.relay.onionServices.sshd = nbLib.mkOnionService { port = 22; };
+    nix-bitcoin.onionAddresses.access.${operatorName} = [ "sshd" ];
+
+    services.bitcoind = {
+      enable = true;
+      listen = true;
+      dbCache = 1000;
+    };
+
+    services.liquidd = {
+      # Enable `validatepegin` to verify that a transaction sending BTC into
+      # Liquid exists on Bitcoin. Without it, a malicious liquid federation can
+      # make the node accept a sidechain that is not fully backed.
+      validatepegin = true;
+      listen = true;
+    };
+
+    nix-bitcoin.nodeinfo.enable = true;
+
+    # vendored: backups removed — was services.backups.frequency = "daily"
+
+    # operator
+    nix-bitcoin.operator.enable = true;
+    users.users.${operatorName} = {
+      openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
+    };
+  };
+}