refactor: move sudo to core, lxc SSH to profile, clean up old lxc config

- sudo (wheelNeedsPassword) → modules/core/core.nix (全局)
- LXC SSH override (PermitRootLogin, PasswordAuth) → profiles/lxc.nix
- modules/server/ssh.nix: use mkDefault so profiles can override
- Delete modules/optional/lxc.nix
- Clean up hosts/nixos-lxc/configuration.nix: remove redundant SSH/sudo/users
  (now handled by core + server + profile chain)
- Update modules/optional/README.md

modules/server/ssh.nix

@@ -1,14 +1,13 @@
-{ ... }:
+{ lib, ... }:
 {
   services.openssh = {
     enable = true;
     openFirewall = true;
     settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-      PermitRootLogin = "no";
-      X11Forwarding = false;
+      PasswordAuthentication = lib.mkDefault false;
+      KbdInteractiveAuthentication = lib.mkDefault false;
+      PermitRootLogin = lib.mkDefault "no";
+      X11Forwarding = lib.mkDefault false;
     };
   };
 }
-