refactor(reverse-proxy): simplify virtual host generation

configs/nixos/AGENTS.md

@@ -65,3 +65,5 @@
   and Zeus), not in the generic host module.
 - Module-relative paths resolve from the module file. Update them when moving a module into a subdirectory.
 - On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.
+- Evaluating a NixOS guest's inner `config.services.nginx` can force incomplete ACME values.
+  Evaluate the parent host's `config.system.build.toplevel` to validate an ACME-enabled guest.