refactor(deploy): rename system user lamassu → bitspire

System-level half of the lamassu → bitspire rebrand the rest of dev
already did at the path / service / package layers. Touches user/group
declarations, every systemd `User=` block, the udev rules filename, all
chown calls in flake.nix + live.nix, the displayManager autoLogin user,
the trusted-users nix entry, provision-atm.sh's ATM_USER, plus README +
CLAUDE.md doc references.

In-place migration for the Sintra dev unit (which auto-pulls dev at
04:00) lives in `system.activationScripts.bitspire-user-migration` and:
- copies `/home/lamassu/.ssh/authorized_keys` → `/home/bitspire/` once,
  so SSH access survives the rename
- recursively chowns `/var/lib/bitspire` to the new bitspire UID on
  every boot — cheap no-op once done, but covers the case where the
  data dir was written by the now-removed lamassu UID
- leaves `/home/lamassu/` in place as evidence; operator can `rm -rf`
  after confirming bitspire login works

Recovery path if the migration breaks SSH access: root key is still in
configuration.nix:142-144 (padreug@gizmo), so ssh root@<host> works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/nixos/udev/99-bitspire-hardware.rules

@@ -0,0 +1,57 @@
+# Lamassu ATM Hardware udev Rules
+# Place in /etc/udev/rules.d/ or use services.udev.extraRules in NixOS
+
+# ============================================
+# Bill Validators
+# ============================================
+
+# ID-003 Bill Validator (JCM/Japan Cash Machine)
+# Uses TI USB-Serial chip
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="3410", MODE="0666", GROUP="dialout", SYMLINK+="bill-validator"
+
+# MEI Bill Validator (Mars Electronics)
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0b00", MODE="0666", GROUP="dialout", SYMLINK+="bill-validator"
+
+# CCNET Bill Validator (CashCode)
+SUBSYSTEM=="tty", ATTRS{idVendor}=="1b5a", MODE="0666", GROUP="dialout", SYMLINK+="bill-validator"
+
+# ============================================
+# Bill Dispensers
+# ============================================
+
+# Puloon Bill Dispenser (uses FTDI chip)
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", MODE="0666", GROUP="dialout", SYMLINK+="bill-dispenser"
+
+# Genmega Bill Dispenser
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6015", MODE="0666", GROUP="dialout", SYMLINK+="bill-dispenser"
+
+# ============================================
+# Generic USB-Serial Adapters
+# ============================================
+
+# Prolific PL2303
+SUBSYSTEM=="tty", ATTRS{idVendor}=="067b", MODE="0666", GROUP="dialout"
+
+# FTDI
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", MODE="0666", GROUP="dialout"
+
+# Silicon Labs CP210x
+SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", MODE="0666", GROUP="dialout"
+
+# CH340/CH341
+SUBSYSTEM=="tty", ATTRS{idVendor}=="1a86", MODE="0666", GROUP="dialout"
+
+# ============================================
+# Camera
+# ============================================
+
+# Allow access to all video4linux devices (cameras)
+SUBSYSTEM=="video4linux", MODE="0666", GROUP="video"
+
+# ============================================
+# Printers
+# ============================================
+
+# Common thermal receipt printers
+SUBSYSTEM=="usb", ATTRS{idVendor}=="04b8", MODE="0666", GROUP="lp"  # Epson
+SUBSYSTEM=="usb", ATTRS{idVendor}=="0519", MODE="0666", GROUP="lp"  # Star Micronics