refactor: KISS cleanup — deduplicate shared config, merge thin files

- Extract fonts, fish.enable, openssh.enable to modules/shared/
- Centralize sshKeys in lib/ via specialArgs
- Merge nixos/base.nix + locale.nix into nixos/default.nix
- Merge home/theme.nix into home/default.nix
- Simplify homeManagerConfig, flake packages output
- Remove redundant vim/wget from NixOS system packages
- Update AGENTS.md to reflect new structure

modules/darwin/default.nix

@@ -1,35 +1,26 @@
-{ pkgs, username, ... }:
+{
+  pkgs,
+  username,
+  sshKeys,
+  ...
+}:
 
 {
   # ── Primary user (required by nix-darwin) ──────────
   system.primaryUser = username;
 
-  # ── Shell ──────────────────────────────────────────
-  programs.fish.enable = true;
-
   # ── 1Password CLI ───────────────────────────────────
   programs._1password.enable = true;
 
-  # ── SSH ───────────────────────────────────────────
-  services.openssh.enable = true;
-
   # ── User ───────────────────────────────────────────
   users.knownUsers = [ username ];
   users.users.${username} = {
     home = "/Users/${username}";
     shell = pkgs.fish;
     uid = 501;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRTOo48gzzRGT+bF9dzJCFJu61YgsQVONFtxU9kTPIg"
-    ];
+    openssh.authorizedKeys.keys = sshKeys;
   };
 
-  # ── Fonts ──────────────────────────────────────────
-  fonts.packages = with pkgs; [
-    maple-mono.NF-CN-unhinted
-    nerd-fonts.symbols-only
-  ];
-
   # ── macOS system preferences ───────────────────────
   system.defaults = {
     LaunchServices.LSQuarantine = false;
@@ -65,7 +56,7 @@
     ];
 
     brews = [
-      "mole" # broken in nixpkgs
+      "mole"
     ];
 
     # GUI apps