refactor(copyparty): separate deployment and service policy

Move Copyparty rendering into shared dotfiles utilities, keep guest wiring focused on host/container plumbing, and let the service module derive effective volume policy.

src/dotfiles/util/default.nix

@@ -0,0 +1,63 @@
+{ lib }:
+let
+  collectNixFiles =
+    dir:
+    lib.flatten (
+      lib.mapAttrsToList (
+        name: type:
+        let
+          path = dir + "/${name}";
+        in
+        if type == "directory" then
+          collectNixFiles path
+        else if type == "regular" && lib.hasSuffix ".nix" name then
+          [ path ]
+        else
+          [ ]
+      ) (builtins.readDir dir)
+    );
+
+  uniqueValue =
+    value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
+in
+{
+  formats.copyparty = import ./format-copyparty.nix { inherit lib; };
+
+  inherit collectNixFiles;
+  removeNixSuffix = path: lib.removeSuffix ".nix" (builtins.baseNameOf path);
+
+  glyph =
+    code:
+    builtins.fromJSON (
+      "\""
+      + (if builtins.isList code then lib.concatMapStrings (part: "\\u${part}") code else "\\u${code}")
+      + "\""
+    );
+
+  registry.predicates.uniqueValue = uniqueValue;
+
+  registry.predicates.uniquePerHost =
+    value:
+    uniqueValue (entry: {
+      inherit (entry) host;
+      value = value entry;
+    });
+
+  bridgeName = id: "br-vlan${toString id}";
+
+  deriveMac =
+    name:
+    let
+      hash = builtins.hashString "sha256" name;
+    in
+    lib.concatStringsSep ":" (
+      [ "02" ]
+      ++ map (i: builtins.substring (i * 2) 2 hash) [
+        0
+        1
+        2
+        3
+        4
+      ]
+    );
+}