refactor: mirror module namespaces to their directories (task 0031)

Adopt the convention that a Module's option path mirrors its directory
under modules/, with an index file naming the directory's own segment.

- Group agent Modules under modules.agents.*: claude-code (whole
  directory), pi (flattened to a file), skills (renamed from
  agent-skills), and gitea-axi under an agents/tools/ subgroup. The
  agents/ and tools/ folders are pure namespace prefixes with no
  aggregator enable.
- Nest hypridle and hyprlock under modules.desktop.hyprland.*, with
  hyprland.nix as the index, and update the desktop aggregator.
- Remove the obsolete example Module.
- Record the convention in CONTEXT.md and ADR 0004, and update the
  neogaia host, the two live CLAUDE.md gotchas, and the skills Module's
  intentional Enable-convention exception comment.

modules/agents/claude-code/authentication.md

@@ -0,0 +1,32 @@
+# Authenticating Claude Code without a browser
+
+`neogaia` is driven from the console and over SSH, where no local browser can service Claude Code's default OAuth redirect.
+Either of the two paths below signs the CLI in from a bare terminal.
+Both are one-time actions per machine; the credentials land under `~/.claude`, which home-manager does not overwrite.
+
+## Paste-code flow (Claude subscription or Console OAuth)
+
+Run `claude` and start the login with the `/login` command (the first run offers it automatically).
+On a machine with no browser it cannot open the authorization page itself, so it prints the authorization URL and waits.
+
+1. Copy the printed URL to a browser on any other device (phone, another laptop).
+2. Sign in and approve the request there.
+3. The page returns a short authorization code; paste it back at the `claude` prompt still waiting in the terminal.
+
+The session then completes and the token is stored, so later runs need no further login.
+Because the URL is opened on a *different* device, this works unchanged over SSH.
+
+## API key
+
+For non-interactive use, set an Anthropic API key from <https://console.anthropic.com> in the environment before launching `claude`:
+
+```console
+$ export ANTHROPIC_API_KEY=sk-ant-...
+$ claude
+```
+
+Claude Code reads `ANTHROPIC_API_KEY` on startup and skips the interactive login entirely, so this path needs neither a browser nor the paste-code exchange.
+Usage is billed to the Console account that owns the key rather than to a Claude subscription.
+
+The key is a secret and is deliberately not baked into this configuration.
+Export it from the shell for a one-off, or source it from a secret store once one exists on the Host.