fix: remove trusted-users escalation, restore comments, move man-db to core

- Remove alex from nix.settings.trusted-users in core.nix (was not in
  the original base.nix and widens attack surface by allowing arbitrary
  binary cache configuration without sudo)
- Restore useful comments in base.nix (zram explanation, earlyoom
  purpose, avahi/systemd-resolved notes)
- Move documentation.man.man-db.enable = false into core.nix so all
  hosts get it, remove redundant setting from wintermute and nightcity

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hosts/modules/core.nix

@@ -21,7 +21,11 @@
 
   programs.fish.enable = true;
 
+  # generating man caches is very slow when fish is enabled and may not
+  # complete during activation. disabling breaks fish man completion and
+  # apropos but is otherwise harmless.
   documentation.man.generateCaches = false;
+  documentation.man.man-db.enable = false;
 
   time.timeZone = "Australia/Brisbane";
 
@@ -45,7 +49,6 @@
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];
     auto-optimise-store = true;
-    trusted-users = [ "root" "alex" ];
   };
 
   nix.gc = {