vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)

- Remove inputs.nix-bitcoin (fort-nix/nix-bitcoin/release) from flake.nix
- Vendor only 6 services actually used by Sovran: bitcoind, electrs,
  lnd (+lndconnect), rtl, btcpayserver, mempool + supporting infra:
  secrets, onion-services/addresses, operator, nodeinfo, security,
  versioning
- All packages now from nixpkgs directly (pkgs.*) — no pinned pkgs
- Keep nix-bitcoin.* option namespace for compatibility
- backups.nix removed: Sovran uses rsnapshot to Second_Drive
  (configuration.nix: hourly/daily to BTCEcoandBackup) — duplicity
  remote backup not needed
- netns-isolation.nix replaced with stub (5 lines): original 365-line
  bridge/iptables/ip-netns broke Caddy/AlbyHub/RTL a year ago and
  is incompatible with nwc-wallets (requires enable=false). Stub
  keeps option valid but warns if enabled.
- Add pkgs/sovran-overlay.nix for gaps only: lndinit + netns-exec stub

pkgs/README.md

@@ -0,0 +1,2 @@
+These packages are provided by nixpkgs directly. No extra pinning needed.
+Missing helpers (lndinit) are vendored below if needed.

pkgs/nbxplorer.nix

@@ -0,0 +1,18 @@
+# Fallback nbxplorer package if not in nixpkgs
+# This is rarely needed — nixpkgs-unstable usually has it
+{ lib, buildDotnetModule, fetchFromGitHub, dotnetCorePackages }:
+buildDotnetModule rec {
+  pname = "nbxplorer";
+  version = "2.5.22";
+  src = fetchFromGitHub {
+    owner = "dgarage";
+    repo = "NBXplorer";
+    rev = "v${version}";
+    sha256 = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+  projectFile = "NBXplorer/NBXplorer.csproj";
+  nugetDeps = ./nbxplorer-deps.nix; # not needed if using nixpkgs version
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
+  meta = with lib; { description = "NBXplorer fallback"; license = licenses.mit; };
+}

pkgs/sovran-overlay.nix

@@ -0,0 +1,37 @@
+# Sovran overlay — provides packages not in nixpkgs or needing overrides
+# All Bitcoin packages are now sourced from nixpkgs (unstable) directly.
+# This overlay only fills gaps where nixpkgs is missing/broken.
+final: prev: let
+  # lndinit is not in nixpkgs — vendor it from nix-bitcoin source
+  lndinit = prev.buildGoModule rec {
+    pname = "lndinit";
+    version = "0.1.3-beta";
+    src = prev.fetchFromGitHub {
+      owner = "lightninglabs";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "sha256-sO1DpbppCurxr9g9nUl9Vx82FJK1mTcUw3rY1Fm1wEU=";
+    };
+    vendorHash = "sha256-El44BS5Bu0K/klMxkajciU/R6uqiXBMOiLN536QztbE=";
+    subPackages = [ "." ];
+    meta = with prev.lib; {
+      description = "Wallet initializer utility for lnd (vendored from nix-bitcoin)";
+      homepage = "https://github.com/lightninglabs/lndinit";
+      license = licenses.mit;
+    };
+  };
+
+  # netns-exec stub — netns isolation is stubbed, this is no-op
+  # If not needed, stub it to coreutils
+  netns-exec = prev.writeShellScriptBin "netns-exec" ''
+    exec "$@"
+  '';
+
+  # nbxplorer is needed by btcpayserver but was removed from nixpkgs in some versions
+  # Use nixpkgs version if available, otherwise build from nix-bitcoin pin
+  nbxplorer = prev.nbxplorer or (prev.callPackage ./nbxplorer.nix {} );
+in {
+  inherit lndinit netns-exec;
+  # Re-expose nbxplorer only if missing
+  nbxplorer = if prev ? nbxplorer then prev.nbxplorer else nbxplorer;
+}