refactor: gate ssh sops symlinks, follow nixos-wsl, fix CRLF

- home/ssh.nix: only create /run/secrets symlinks when secrets exist
- flake.nix: nixos-wsl explicit nixpkgs follows
- fix CRLF line endings: nvchad.nix, virtualbox-guest.nix, docker.nix

home/ssh.nix

@@ -1,12 +1,18 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  # 与 modules/core/sops.nix 保持同一开关：secrets 文件存在时才启用。
+  secretsEnabled = builtins.pathExists ../../secrets/users/luochen570.enc.yaml;
+in
 {
   programs.ssh.enable = true;
 
-  # ~/.ssh/id_rsa 来自 sops secret 文件。
+  home.file = lib.mkIf secretsEnabled {
-  home.file.".ssh/id_rsa".source =
+    # ~/.ssh/id_rsa 来自 sops secret 文件。
-    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";
+    ".ssh/id_rsa".source =
+      config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";
 
-  # ~/.ssh/config 来自 sops secret 文件。
+    # ~/.ssh/config 来自 sops secret 文件。
-  home.file.".ssh/config".source =
+    ".ssh/config".source =
-    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
+      config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
+  };
 }