refactor(nixos): group SSH configuration bindings

configs/nixos/modules/network/ssh.nix

@@ -5,35 +5,21 @@
   ...
 }:
 # Configures inbound and outbound SSH access.
+# Keep bindings grouped by purpose rather than dependency traversal.
+# NOLINT(let_order)
 let
-  cfg = config.modules.network.ssh; # NOLINT(let_order)
+  cfg = config.modules.network.ssh;
-  defaultAuthorizedKeys = lib.flatten (
-    clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
-  );
-  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names);
-
-  targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
-  mkTarget = name: target: {
-    hostName = target.hostName or name;
-    user = target.user or user;
-    port = target.port or 22;
-    aliases = target.aliases or [ name ];
-    clientKey = target.clientKey or null;
-    hostKeys = target.hostKeys or [ ];
-  };
   user = config.user.name;
 
-  managedTargets = lib.genAttrs managedHostNames (name: {
-    hostName = registry.address.${name}.self;
-    clientKey = clientKeyFor name;
-    hostKeys = hostKeysFor name;
-  });
-  managedHostNames = workstationNames ++ serverNames;
   workstationNames = [
     "neogaia"
     "zeus"
   ];
   serverNames = [ "pikachu" ];
+  managedHostNames = workstationNames ++ serverNames;
+  isWorkstation = lib.elem config.networking.hostName workstationNames;
+  isServer = lib.elem config.networking.hostName serverNames;
+
   clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
   hostKeysFor =
     host:
@@ -41,7 +27,11 @@ let
       (../../hosts + "/${host}/ssh_host_ed25519_key.pub")
       (../../hosts + "/${host}/ssh_host_rsa_key.pub")
     ];
-
+  managedTargets = lib.genAttrs managedHostNames (name: {
+    hostName = registry.address.${name}.self;
+    clientKey = clientKeyFor name;
+    hostKeys = hostKeysFor name;
+  });
   extraTargets = {
     # TODO: Pin Gitea's host key after migrating it from Proxmox.
     gitea = {
@@ -54,7 +44,31 @@ let
       ];
     };
   };
-  isServer = lib.elem config.networking.hostName serverNames;
+  mkTarget = name: target: {
+    hostName = target.hostName or name;
+    user = target.user or user;
+    port = target.port or 22;
+    aliases = target.aliases or [ name ];
+    clientKey = target.clientKey or null;
+    hostKeys = target.hostKeys or [ ];
+  };
+  targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
+
+  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names);
+  defaultAuthorizedKeys = lib.flatten (
+    clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
+  );
+  outboundTargetNames =
+    let
+      groupTargets =
+        if isServer then
+          [ "gitea" ] ++ serverNames
+        else if isWorkstation then
+          [ "gitea" ] ++ serverNames ++ workstationNames
+        else
+          [ "gitea" ];
+    in
+    lib.filter (name: name != config.networking.hostName) groupTargets;
 
   knownHosts = lib.listToAttrs (
     lib.concatLists (
@@ -77,7 +91,6 @@ let
       names = lib.unique (target.aliases ++ [ target.hostName ]);
     in
     map withPort names;
-
   keyWithoutComment = key: lib.concatStringsSep " " (lib.take 2 (lib.splitString " " key));
 
   sshSettingsFor =
@@ -92,19 +105,6 @@ let
     }
     // lib.optionalAttrs (target.port != 22) { Port = target.port; };
 
-  outboundTargetNames =
-    let
-      groupTargets =
-        if isServer then
-          [ "gitea" ] ++ serverNames
-        else if isWorkstation then
-          [ "gitea" ] ++ serverNames ++ workstationNames
-        else
-          [ "gitea" ];
-    in
-    lib.filter (name: name != config.networking.hostName) groupTargets;
-  isWorkstation = lib.elem config.networking.hostName workstationNames;
-
   hostKeySecret = type: "ssh-host-${type}-key";
   hostKeyTypes = [
     "ed25519"