refactor: flatten the single-file lib and system directories

Each held one default.nix, so the directory added a level to descend without
grouping anything. They are now lib.nix and system.nix beside flake.nix, which
reads as the flake's own scaffolding.

The shared base config's reference to the shared secrets file was relative to
the directory it sat in, so it moves with the file.

Verified to build the same system toplevel as before the move.

lib.nix

@@ -0,0 +1,74 @@
+{
+  lib,
+  inputs,
+  self,
+}:
+let
+  inherit (lib)
+    attrNames
+    filterAttrs
+    genAttrs
+    flatten
+    hasSuffix
+    mapAttrsToList
+    ;
+
+  # Recursively collect every `.nix` file under `dir` as a flat list, for a
+  # module's `imports`.
+  collectNixFiles =
+    dir:
+    flatten (
+      mapAttrsToList (
+        name: type:
+        let
+          path = dir + "/${name}";
+        in
+        if type == "directory" then
+          collectNixFiles path
+        else if type == "regular" && hasSuffix ".nix" name then
+          [ path ]
+        else
+          [ ]
+      ) (builtins.readDir dir)
+    );
+
+  # Build one host: every module is imported unconditionally (inert until its
+  # `enable` flag is set), alongside home-manager, chaotic, the shared base, and
+  # the host's own directory.
+  mkHost =
+    {
+      hostName,
+      system ? "x86_64-linux",
+    }:
+    inputs.nixpkgs.lib.nixosSystem {
+      inherit system;
+      specialArgs = {
+        inherit inputs;
+        my = self.lib;
+      };
+      modules = (collectNixFiles (self + "/modules")) ++ [
+        inputs.home-manager.nixosModules.home-manager
+        inputs.chaotic.nixosModules.default
+        inputs.disko.nixosModules.disko
+        inputs.sops-nix.nixosModules.sops
+        (self + "/system.nix")
+        (self + "/hosts/${hostName}")
+        { networking.hostName = hostName; }
+      ];
+    };
+
+  # Discover every host (a subdirectory of `hostsDir`) and build each one.
+  mkHosts =
+    hostsDir:
+    let
+      hostNames = attrNames (filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir));
+    in
+    genAttrs hostNames (hostName: mkHost { inherit hostName; });
+in
+{
+  inherit
+    collectNixFiles
+    mkHost
+    mkHosts
+    ;
+}