Cleanup: Remove reverse SSH tunnel code, fix documentation accuracy

Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/3941ead1-cb20-4686-92bb-46e447791ae3

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>

modules/core/remote-deploy.nix

@@ -8,30 +8,6 @@ in
   options.sovran_systemsOS.deploy = {
     enable = lib.mkEnableOption "Remote deploy mode";
 
-    relayHost = lib.mkOption {
-      type = lib.types.str;
-      default = "";
-      description = "SSH relay server hostname or IP for the reverse tunnel";
-    };
-
-    relayPort = lib.mkOption {
-      type = lib.types.port;
-      default = 22;
-      description = "SSH port on the relay server";
-    };
-
-    relayUser = lib.mkOption {
-      type = lib.types.str;
-      default = "deploy";
-      description = "Username on the relay server";
-    };
-
-    reverseTunnelPort = lib.mkOption {
-      type = lib.types.port;
-      default = 2222;
-      description = "Port on the relay that maps back to this machine's SSH (port 22)";
-    };
-
     authorizedKey = lib.mkOption {
       type = lib.types.str;
       default = "";
@@ -120,29 +96,6 @@ in
       path = [ pkgs.tailscale pkgs.coreutils ];
     };
 
-    # ── Reverse tunnel service (only when relayHost is configured) ───────────
-    systemd.services.deploy-reverse-tunnel = lib.mkIf (cfg.relayHost != "") {
-      description = "Deploy reverse SSH tunnel to ${cfg.relayHost}";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" "sshd.service" ];
-      wants = [ "network-online.target" ];
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "10s";
-        ExecStart = "${pkgs.openssh}/bin/ssh"
-          + " -o StrictHostKeyChecking=accept-new"
-          + " -o ServerAliveInterval=30"
-          + " -o ServerAliveCountMax=3"
-          + " -o ExitOnForwardFailure=yes"
-          + " -i /var/lib/secrets/deploy-relay-key"
-          + " -N"
-          + " -R ${toString cfg.reverseTunnelPort}:localhost:22"
-          + " -p ${toString cfg.relayPort}"
-          + " ${cfg.relayUser}@${cfg.relayHost}";
-      };
-      path = [ pkgs.openssh ];
-    };
-
     # ── Safety auto-expiry service ────────────────────────────────────────────
     systemd.services.deploy-auto-expire = {
       description = "Auto-expire remote deploy mode after 48 hours";
@@ -155,7 +108,7 @@ in
       script = ''
         # 48 hours = 172800 seconds
         sleep $((48 * 60 * 60))
-        systemctl stop deploy-reverse-tunnel || true
+        systemctl stop deploy-tailscale-connect || true
         mkdir -p /etc/sovran
         echo "expired" > /etc/sovran/deploy-mode
       '';