docs: correct false claims in the README

Verified against nix eval, upstream sources and a local test:

- testvm accepts SSH password authentication (NixOS default), the README
  claimed the opposite
- only /boot goes through by-partlabel; the filesystems inside the container
  come up as /dev/mapper/crypted
- kanshi parses an empty config fine; a missing one is the error case, in the
  README and in the desktop module comment
- modules/user.nix ABOUTME claimed a login name shared by every host
- the flake imports six modules, not five

Rewrites "Keeping a machine up to date": the checkout is ~/flakes/moonix and
/etc/nixos/flake.nix a symlink to it, which man 8 nixos-rebuild documents.
Drops the git and ssh-keygen basics. Adds an optional LUKS header backup step,
and records the checkout decision in DECISIONS.md.

modules/desktop.nix

@@ -52,10 +52,11 @@ in
     "xdg/quickshell/moonarch".source = "${xdg}/quickshell/moonarch";
     "xdg/foot/foot.ini".source = "${xdg}/foot/foot.ini";
     "xdg/fastfetch/config.jsonc".source = "${xdg}/fastfetch/config.jsonc";
-    # defaults/xdg/kanshi/config is an empty placeholder — on Arch too. kanshi
-    # rejects it ("failed to parse config file") and restarts in a loop, so it
-    # is not deployed. Monitor profiles are machine specific and belong in
-    # ~/.config/kanshi/config.
+    # defaults/xdg/kanshi/config is an empty placeholder — on Arch too. Not
+    # deployed: monitor profiles are machine specific and belong in
+    # ~/.config/kanshi/config. An empty file parses fine; a missing one is what
+    # kanshi reports as "failed to parse config file", which is why the unit in
+    # modules/services.nix waits for the home config to exist.
     "xdg/Kvantum/kvantum.kvconfig".source = "${xdg}/Kvantum/kvantum.kvconfig";
     "xdg/qt6ct/qt6ct.conf".source = "${xdg}/qt6ct/qt6ct.conf";
     "xdg/gtk-3.0/settings.ini".source = "${xdg}/gtk-3.0/settings.ini";