fix(deploy): add --refresh flag to auto-upgrade

Without --refresh, nix caches the flake evaluation and
nixos-upgrade may not pull the latest commits. The --refresh
flag forces re-fetching the git repo on every upgrade.

Only affects flake evaluation cache — /var/lib data is untouched.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flake.nix

@@ -148,6 +148,7 @@
               system.autoUpgrade = {
                 enable = true;
                 flake = "git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git#${machineModel}-installed";
+                flags = [ "--refresh" ];
                 dates = "04:00"; # daily at 4am
                 allowReboot = false;
               };