refactor: move sudo to core, lxc SSH to profile, clean up old lxc config

- sudo (wheelNeedsPassword) → modules/core/core.nix (全局)
- LXC SSH override (PermitRootLogin, PasswordAuth) → profiles/lxc.nix
- modules/server/ssh.nix: use mkDefault so profiles can override
- Delete modules/optional/lxc.nix
- Clean up hosts/nixos-lxc/configuration.nix: remove redundant SSH/sudo/users
  (now handled by core + server + profile chain)
- Update modules/optional/README.md

profiles/lxc.nix

@@ -2,5 +2,13 @@
 {
   imports = [
     ../modules/core
+    ../modules/server
   ];
+
+  # LXC 容器需要密码登录（s0.sermc.net，无 SSH key 注入）
+  services.openssh.settings = {
+    PermitRootLogin = "prohibit-password";
+    PasswordAuthentication = true;
+    KbdInteractiveAuthentication = true;
+  };
 }