Add navi deployment module and integrate SSH inventory for remote management

- Introduced a new `navi` module for managing deployments across multiple hosts.
- Enhanced SSH inventory management to support public key application for authorized hosts.
- Configured system deployment builder for seamless integration with Navi.
- Updated various host configurations to enable deployment capabilities and streamline SSH access.

modules/lib/ssh-inventory.nix

@@ -60,10 +60,17 @@
             (builtins.attrNames selectedHosts)
         );
 
-      # Must come before inventory `Host` blocks and before `Host *`: LAN Gitea SSH is not a catalog PC,
-      # and `Host *` sets `IdentityAgent none` — without this, git@nix-server never sees rbw keys.
+      # Gitea git-over-SSH listens on port 222. System SSH (nix deploy, server@…) uses port 22
+      # via the catalog `nix-server` Host block — never list nix-server or 192.168.2.238 here.
       giteaSshBlock = identityAgent: ''
-        Host git.chiasson.cloud gitea nix-server 192.168.2.238
+        Host git.chiasson.cloud gitea
+          HostName 192.168.2.238
+          Port 222
+          User git
+          IdentityAgent ${identityAgent}
+          IdentitiesOnly no
+
+        Match host nix-server,192.168.2.238 user git
           HostName 192.168.2.238
           Port 222
           User git
@@ -84,11 +91,16 @@
                 entry = selectedHosts.${hostName};
                 hostPatterns = builtins.concatStringsSep " " (entry.aliases ++ [ entry.hostName ]);
                 userLine = if user == null then "" else "  User ${user}\n";
+                portLine =
+                  if hostName == "nix-server" then
+                    "  Port 22\n"
+                  else
+                    "";
               in
               ''
                 Host ${hostPatterns}
                   HostName ${entry.hostName}
-${userLine}              IdentityFile ~/${mkIdentityFileName hostName}
+${userLine}${portLine}                  IdentityFile ~/${mkIdentityFileName hostName}
                   IdentityAgent ${identityAgent}
                   IdentitiesOnly yes
               '')