chore: scaffold flake + settings + entry-point quartet

Single-source-of-truth pattern: settings.nix threads identity, host,
and remote topology into every module via specialArgs. configuration.nix
and home.nix stay thin import-lists so module composition is obvious.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

settings.nix

@@ -0,0 +1,51 @@
+# lnbits-sensei — single source of truth.
+#
+# Fill in the placeholders below. These values are threaded into every
+# NixOS module and home-manager submodule via `specialArgs` /
+# `extraSpecialArgs` in flake.nix, so no module ever has to re-import
+# this file.
+#
+# Identity values (user / gitName / gitEmail) intentionally have
+# CHANGEME-style placeholders. The skeleton MUST evaluate to nothing
+# useful until you replace them — that's the safety release valve
+# against accidentally building someone else's identity into your fork.
+{
+  # Primary login user on the host. Also the home-manager target.
+  user = "CHANGEME";
+
+  # Git author identity used by the user account on this host.
+  # Wired into `programs.git.userName` / `programs.git.userEmail` in
+  # home.nix.
+  gitName = "Your Name";
+  gitEmail = "you@example.com";
+
+  # NixOS hostname. Also names the `nixosConfigurations.<hostName>`
+  # entry in flake.nix, so `nixos-rebuild --flake .#<hostName>` works
+  # without extra ceremony.
+  hostName = "lnbits-sensei";
+
+  # IANA tz database name. UTC is a safe default; override for any
+  # host with humans nearby.
+  timeZone = "UTC";
+
+  # Remote topology for the LNbits checkout managed by this host.
+  # See modules/git/remotes.nix for the option schema and
+  # docs/remotes.md for the three supported patterns
+  # (upstream-only / github-fork / multi-remote with private host).
+  git = {
+    remotes = {
+      # Canonical upstream. Almost always lnbits/lnbits unless you're
+      # tracking a long-lived divergent fork.
+      upstream = "https://github.com/lnbits/lnbits";
+
+      # Personal GitHub fork — set when you intend to send PRs upstream.
+      # Leave null to skip adding a `fork` remote.
+      fork = null;
+
+      # Extra remotes (private forgejo, gitea, codeberg, …). Each entry
+      # is { name = "<remote-name>"; url = "<url>"; }. Leave empty for
+      # the simple cases.
+      extras = [ ];
+    };
+  };
+}