Remove checker service (#9)

## Summary

- Remove the checker NixOS module, including its systemd service, system user/group, SOPS secret declaration, and nginx virtual host.
- Remove the checker flake input and its now-unreachable lock-file dependency graph.

## Validation

- `tobserver-agent check` — passed all formatting, whitespace, no-build flake, strict NixOS assertion/systemd unit, secret-policy, and Gitleaks checks.
- Focused Nix evaluation confirmed the checker service, user, nginx virtual host, and SOPS secret declaration are absent; `flake.lock` no longer contains the checker input.

## Risks and limitations

- Deployment will stop exposing the checker service and nginx virtual host, but existing runtime state, a mutable system user, DNS records, ACME data, and the encrypted checker secret may remain until a human removes them if desired.

## Manual follow-up

- Review and merge this pull request in Codeberg.
- Deploy manually on Tobserver after merge.
- After deployment, verify the checker unit and virtual host are absent; optionally clean up checker DNS, runtime state, user, ACME data, and the encrypted secret through the appropriate human-managed process.

Reviewed-on: https://codeberg.org/oibot/Tobserver/pulls/9

modules/checker.nix

@@ -1,53 +0,0 @@
-{ config, pkgs, checker, ... }:
-
-let
-  checkerPkg = checker.packages.${pkgs.stdenv.hostPlatform.system}.default;
-in
-{
-  users.users.checker = {
-    isSystemUser = true;
-    group = "checker";
-    home = "/var/lib/checker";
-    createHome = true;
-  };
-
-  users.groups.checker = {};
-
-  sops.secrets."checker/env" = {
-    owner = "checker";
-    group = "checker";
-    mode = "0400";
-  };
-
-  systemd.services.checker = {
-    description = "Checker a personal assistant";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-
-    serviceConfig = {
-      User = "checker";
-      Group = "checker";
-      WorkingDirectory = "/var/lib/checker";
-      ExecStart = "${checkerPkg}/bin/checker";
-      EnvironmentFile = config.sops.secrets."checker/env".path;
-
-      Restart = "always";
-      RestartSec = 5;
-
-      NowNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ReadWritePaths = [ "/var/lib/checker" ];
-    };
-  };
-
-  services.nginx.virtualHosts."checker.tobiasostner.de" = {
-    enableACME = true;
-    forceSSL = true;
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:3001";
-    };
-  };
-}