feat(neogaia): declare the encrypted disk with disko

Add disko as a flake input (following nixpkgs) and wire its NixOS module
into the host-builder, so any Host can declare a disk layout while the
layout itself stays a per-Host concern.

neogaia's layout (hosts/neogaia/disk.nix): one GPT NVMe disk with a
systemd-boot EFI system partition and a LUKS container holding btrfs with
@root/@home/@nix subvolumes. The initrd prompts for the passphrase on a
normal boot. Swap is RAM-backed zram, so there is no on-disk swap
partition; zramSwap is enabled directly for now. The placeholder
fileSystems are removed since disko now derives them.

hosts/neogaia/default.nix

@@ -1,23 +1,23 @@
 { ... }:
 # neogaia — Dell XPS 13 9380 laptop.
 #
-# The filesystems and hardware profile below are placeholder values, not the
-# machine's real encrypted layout.
+# The disk layout lives in ./disk.nix (disko); the resulting `fileSystems` are
+# derived from it, so none are declared by hand here.
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    ./disk.nix
+  ];
 
   system.stateVersion = "26.05";
 
+  # systemd-boot on the EFI system partition disko creates. The initrd prompts
+  # for the LUKS passphrase (disko wires up boot.initrd.luks.devices), so a
+  # normal boot unlocks the encrypted root.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  # Placeholder label-based filesystems.
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/BOOT";
-    fsType = "vfat";
-  };
+  # Swap is RAM-backed zram rather than an on-disk partition. Task 0003 lifts
+  # this into the zram toggle Module; enabled directly here for now.
+  zramSwap.enable = true;
 }