fix: authenticate nix github fetches to dodge the 60/hr rate limit

Unauthenticated flake input fetches from github.com were hitting 429.
Token lives in /etc/nix/github-token.conf (root:root 600, out-of-band —
never in git or /nix/store) and nix.conf !includes it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/common/global/nix.nix

@@ -23,6 +23,14 @@
     # GC is handled by `nh clean` below (keep-N / keep-since semantics).
     # The two are mutually exclusive — nh asserts if nix.gc.automatic is on.
     gc.automatic = false;
+
+    # Unauthenticated GitHub API calls (flake input fetches) are capped at
+    # 60/hr and 429 quickly. The token itself must not land in /nix/store
+    # (world-readable), so it lives in a plain file outside Nix's management —
+    # !include reads it at nix.conf parse time instead of embedding it.
+    extraOptions = ''
+      !include /etc/nix/github-token.conf
+    '';
   };
 
   # nh: ergonomic nixos-rebuild wrapper. Auto-detects the target from the