heather/common: passwordless sudo for mikl + fix deprecated options

- common/default.nix: add mikl to wheel + security.sudo.wheelNeedsPassword=false.
  Without this, root is unreachable on a fresh NixOS-yc image (no root password,
  no rescue channel) — nixos-rebuild switch is impossible. Mirrors the
  NOPASSWD:ALL that old YC boxes got via cloud-config user-data.
- home/server.nix: programs.git.extraConfig -> .settings, programs.git.delta
  -> programs.delta with enableGitIntegration=true (deprecated warnings).
- image.nix: boot.loader.grub.timeout -> boot.loader.timeout (renamed option).

hosts/common/default.nix

@@ -13,6 +13,16 @@
     isNormalUser = true;
     shell = pkgs.zsh;
     home = "/home/mikl";
+    extraGroups = [ "wheel" ];   # для passwordless sudo (см. ниже)
+  };
+
+  # Passwordless sudo для mikl на NixOS-серверах.
+  # На старых YC-боксах это приходило через cloud-config user-data
+  # (NOPASSWD:ALL); в NixOS задаём декларативно. Без этого админить
+  # сервер вслепую (kubectl, journalctl, nixos-rebuild) невозможно.
+  security.sudo = {
+    enable = true;
+    wheelNeedsPassword = false;
   };
 
   environment.systemPackages = [