heather: replace k3s with docker+arion+caddy+syncthing

- remove k3s.nix (1.3GB overhead unjustified for single-node)
- add docker.nix (docker + arion CLI, mikl in docker group)
- add caddy.nix (edge proxy, TLS via ACME staging, host-based routing)
- add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing)
- add arion-compose.nix (forgejo first, others stubbed as TODO)
- add arion flake input + nixos module
- default.nix: wire up arion project as systemd service (serviceName=heather)

Architecture: Caddy (host) terminates TLS, routes to host services (syncthing)
and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except
silverbullet (bind /srv/syncthing/herbarium).

flake.nix

@@ -18,10 +18,15 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    arion = {
+      url = "github:hercules-ci/arion";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
-    { self, nixpkgs, nix-darwin, home-manager, sops-nix, ... }:
+    { self, nixpkgs, nix-darwin, home-manager, sops-nix, arion, ... }:
     let
       mkNixos = hostname:
         nixpkgs.lib.nixosSystem {
@@ -31,6 +36,7 @@
             ./hosts/${hostname}
             sops-nix.nixosModules.sops
             home-manager.nixosModules.home-manager
+            arion.nixosModules.arion
             {
               home-manager = {
                 useGlobalPkgs = true;