refactor: move sudo to core, lxc SSH to profile, clean up old lxc config

- sudo (wheelNeedsPassword) → modules/core/core.nix (全局)
- LXC SSH override (PermitRootLogin, PasswordAuth) → profiles/lxc.nix
- modules/server/ssh.nix: use mkDefault so profiles can override
- Delete modules/optional/lxc.nix
- Clean up hosts/nixos-lxc/configuration.nix: remove redundant SSH/sudo/users
  (now handled by core + server + profile chain)
- Update modules/optional/README.md

modules/core/core.nix

@@ -24,4 +24,7 @@
   time.timeZone = lib.mkDefault "Asia/Shanghai";
   i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
 
+  # 允许 wheel 组免密 sudo
+  security.sudo.wheelNeedsPassword = false;
+
 }