Onboard mx1 mail host and factor out per-host public IPs

- Register mx1 in the inventory and as a direct-SSH `internet` host; give it
  a static public IPv6 (2a01:4ff:2f0:1963::1).
- Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record.
- Bring mx1 into monitoring: import exporters, add it to the mesh map and the
  node scrape job so its host metrics and journald reach control.
- Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public
  SSH (admin rides the mesh like the other hosts). 587/465/993 held for now.
- Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by
  clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address
  is declared once instead of being duplicated across configs.
- docs: add mx1 to the machines table.

clan.nix

@@ -1,4 +1,6 @@
 let
+  hosts = import ./modules/hosts.nix;
+
   # This clan-core pins the zerotier `allowedIps` interface (admit by network
   # IPv6), but node IDs are the stable per-device handle (what `zerotier-cli
   # info` prints). Derive a member's IP on THIS network from the controller's
@@ -21,6 +23,7 @@ in
     control = { };
     ns1 = { };
     ns2 = { };
+    mx1 = { };
   };
 
   inventory.instances = {
@@ -51,14 +54,12 @@ in
     };
 
     # Direct SSH to public IPs — clan's priority-1 connection path, with the
-    # ZeroTier mesh and Tor kept as automatic fallbacks. Raw IPs (not the
-    # ns1/ns2 DNS names) so reaching these hosts never depends on their own
-    # DNS being up.
-    internet = {
-      roles.default.machines.control.settings.host = "77.42.68.181";
-      roles.default.machines.ns1.settings.host = "46.224.170.206";
-      roles.default.machines.ns2.settings.host = "157.180.70.82";
-    };
+    # ZeroTier mesh and Tor kept as automatic fallbacks. Raw IPs (from
+    # modules/hosts.nix, not the ns1/ns2 DNS names) so reaching these hosts never
+    # depends on their own DNS being up.
+    internet.roles.default.machines = builtins.mapAttrs (_: h: {
+      settings.host = h.ipv4;
+    }) hosts;
 
     # Recovery root password for console access when a machine fails to boot.
     emergency-access = {