password-model.nix: fix Nix string escaping in the generate fallback

The word-picking one-liner used `eval echo \${...}`, but in a Nix
indented string a backslash does not escape `${` -- it starts
interpolation, so evaluation failed with "syntax error, unexpected
invalid token". Replace the eval/positional-parameter trick with a
plain `shuf` pipeline that contains no `${` at all.

Found by nixos-rebuild boot on staging-dev. The shell logic itself was
tested; the file had not been parse-checked by Nix. Re-scanned the
whole module: every remaining `${` is an intended interpolation and
every `''` is a string delimiter.

modules/password-model.nix

@@ -61,7 +61,7 @@ let
              pixel plum pond prism quartz raven ridge river robin rocky rose rowan sage sand
              sierra silver slate snow solar spark spruce stone storm summit swift thorn tide
              timber torch trout vale vault vine walnut wave willow wren"
-          pw=$(for i in 1 2 3 4; do set -- $W; eval echo \${$((RANDOM % $# + 1))}; done | paste -sd- -)-$(printf '%02d' $((RANDOM % 100)))
+          pw=$(echo $W | tr ' ' '\n' | shuf -n4 | paste -sd- -)-$(printf '%02d' $((RANDOM % 100)))
           umask 077; printf '%s\n' "$pw" > "$f"
           echo "${account}:$pw" | chpasswd
         ''}