Let's Encrypt refuses .r names and the vhosts on ca.r keep failing to
renew, so serve paste/cyberlocker (c.r, p.r), radio.r, radio-news.r and
yellow's flix vhosts over plain http instead.

Every machine now uses networking.firewall on networking.nftables with
the same defaults krebs.iptables had: input and forward drop, all ICMP
accepted, no reverse path filter. Open ports and trusted interfaces are
unchanged on all machines.

- interface port rules become firewall.interfaces.<if>.allowed*Ports,
interface-wide accepts trustedInterfaces
- forwarding goes through extraForwardRules; yellow keeps forward
unfiltered for the transmission namespace
- NAT rules become per-module networking.nftables.tables
- ssh-redirect: 45621 redirects to 22, new connections to 22 are reset
unless they come from lo, retiolum or wiregrill
- xerxes: the JOOL xtables target is added by jool-iptables through
ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension
- flushRuleset = false so libvirt/podman/jool tables survive reloads;
extraDeletions drops the iptables-nft tables krebs.iptables left

Rules that were silently ignored while networking.firewall was disabled,
such as clan's yggdrasil filter, now take effect.

Reference the stockholm packages we still use through
stockholm.packages.<system> instead of its overlay.

nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash,
writeDashBin, writeBashBin and write (now linkFarm).

Nothing uses them; red-host reads the clan vars secretLocation directly.

Copied from stockholm krebs/3modules/realwallpaper.nix (cc283503); the
wallpaper generator comes from stockholm's packages output instead of
its overlay.

Copied from stockholm krebs/3modules/reaktor2.nix (cc283503). The bot
itself goes to pkgs/reaktor2 (with blessings, which nixpkgs lacks),
since stockholm's packages output does not include it.

Copied from stockholm krebs/3modules/htgen.nix (cc283503), so it no
longer needs pkgs.htgen from the stockholm overlay.