deploy now always takes a machine and a target host. It extracts the
bulk key once, runs clan vars generate, copies the flake source to
/var/lib/deploy/incoming over ssh, builds it there in the transient unit
deploy-build (progress via nom), shows the source diff against the
running system's source and the closure diff, asks, uploads secrets and
switches in deploy-switch. Both units survive the ssh connection dying;
rerunning deploy attaches to a running one.

Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the
superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts,
and drop krebs.build.host everywhere: readers now use kartei.hosts or
networking.hostName, which comes from the clan machine name.

- remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users
locally
- drop the acheron/starkstrom krebs.hosts cards; both now appear in every
machine's /etc/hosts
- neoprism: stop serving /hosts and /retiolum.hosts
- ignavia: move the styx tinc Address override onto the kartei-built host
file; the krebs.hosts one had no effect since the kartei cutover