refactor(nixos): isolate SSH fleet configuration

configs/nixos/modules/network/ssh.nix

@@ -5,12 +5,19 @@
   ...
 }:
 # Configures inbound and outbound SSH access.
-# Keep bindings grouped by purpose rather than dependency traversal.
+let
+  cfg = config.modules.network.ssh; # NOLINT(let_order)
+  defaultAuthorizedKeys = lib.flatten (
+    clientKeysFor fleet.workstationNames
+    ++ lib.optional fleet.isServer (clientKeysFor fleet.serverNames)
+  );
+  clientKeysFor =
+    names: lib.filter (key: key != null) (map (name: fleet.targets.${name}.clientKey) names);
+
+  fleet =
+    # Keep fleet policy and target construction in conceptual order.
     # NOLINT(let_order)
     let
-  cfg = config.modules.network.ssh;
-  user = config.user.name;
-
       workstationNames = [
         "neogaia"
         "zeus"
@@ -53,11 +60,6 @@ let
         hostKeys = target.hostKeys or [ ];
       };
       targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
-
-  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names);
-  defaultAuthorizedKeys = lib.flatten (
-    clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
-  );
       outboundTargetNames =
         let
           groupTargets =
@@ -69,6 +71,17 @@ let
               [ "gitea" ];
         in
         lib.filter (name: name != config.networking.hostName) groupTargets;
+    in
+    {
+      inherit
+        isServer
+        outboundTargetNames
+        serverNames
+        targets
+        workstationNames
+        ;
+    };
+  user = config.user.name;
 
   knownHosts = lib.listToAttrs (
     lib.concatLists (
@@ -81,7 +94,7 @@ let
             publicKey = keyWithoutComment key;
           }
         ) target.hostKeys
-      ) targets
+      ) fleet.targets
     )
   );
   knownHostNamesFor =
@@ -96,7 +109,7 @@ let
   sshSettingsFor =
     name:
     let
-      target = targets.${name};
+      target = fleet.targets.${name};
     in
     {
       header = "Host ${lib.concatStringsSep " " target.aliases}";
@@ -161,7 +174,7 @@ in
           enable = true;
           enableDefaultConfig = false;
           settings = lib.mapAttrs (name: _: sshSettingsFor name) (
-            lib.genAttrs outboundTargetNames (name: name)
+            lib.genAttrs fleet.outboundTargetNames (name: name)
           );
         };
       }