fix(nixos): address Nix review findings

Render Palworld secrets through its documented settings file and remove stale RCON configuration.

Harden generated commands, centralize shared modules, and codify the reviewed Nix conventions.

configs/nixos/modules/services/steamcmd.nix

@@ -15,7 +15,7 @@
     };
 
     serviceName = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.strMatching "[A-Za-z0-9_.@-]+";
       example = "valheim";
       description = "Name of the systemd service that runs the game server.";
     };
@@ -87,10 +87,11 @@
         prepareScript = pkgs.writeShellScript "steamcmd-${service.serviceName}-prepare" ''
           set -eu
 
-          ${pkgs.coreutils}/bin/install -d \
+          ${lib.getExe' pkgs.coreutils "install"} -d \
             -o ${user} \
             -g ${group} \
             -m 0770 \
+            -- \
             ${lib.escapeShellArg service.steamDir} \
             ${lib.escapeShellArg service.installDir} \
             ${lib.escapeShellArg service.stateDir}
@@ -110,7 +111,7 @@
         startScript = pkgs.writeShellScript "steamcmd-${service.serviceName}-start" ''
           set -eu
 
-          cd ${lib.escapeShellArg service.installDir}
+          cd -- ${lib.escapeShellArg service.installDir}
           export LD_LIBRARY_PATH=linux64:''${LD_LIBRARY_PATH-}
           exec ${lib.getExe pkgs.steam-run} ${lib.escapeShellArg service.executable} ${lib.escapeShellArgs service.arguments}
         '';
@@ -155,7 +156,7 @@
             wantedBy = lib.mkIf service.autoStart [ "multi-user.target" ];
             serviceConfig = {
               Type = "oneshot";
-              ExecStart = "${pkgs.systemd}/bin/systemctl --no-block start ${service.serviceName}.service";
+              ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --no-block -- start ${service.serviceName}.service";
             };
           };