feat: add gortium.clamav NixOS module

- New module at modules/nixos/services/clamav.nix
- Options: enable (CLI-only), enableDaemon (full services),
  onAccessScanning (clamonacc), scanPaths, dailyScanTime
- All scans are logging-only — no auto-quarantine or deletion
- uConsole: CLI tools only (enableDaemon=false)
- lazyworkhorse: full setup with on-access scanning, daily 3 AM scan

Also: remove neovim from uConsole (fails cross-compile, emacs available)

flake.nix

@@ -194,6 +194,7 @@
         ./hosts/uconsole-cm5/hardware-configuration.nix
         ./modules/nixos/services/remote-builder.nix
         ./modules/nixos/services/wireguard-client.nix
+        ./modules/nixos/services/clamav.nix
         ./modules/nixos/security/ai-worker-restricted.nix
         ./users/gortium/gortium.nix
         ./users/ai-worker/ai-worker.nix
@@ -219,6 +220,7 @@
             ./modules/nixos/filesystem/poup-16t-disk.nix
             ./modules/nixos/services/ollama_init_custom_models.nix
             ./modules/nixos/services/open_code_server.nix
+            ./modules/nixos/services/clamav.nix
             ./modules/nixos/security/ai-worker-restricted.nix
             ./users/gortium/gortium.nix
             ./users/ai-worker/ai-worker.nix
@@ -237,7 +239,7 @@
             ./hosts/cyt-pi/configuration.nix
             ./hosts/cyt-pi/hardware-configuration.nix
             ./modules/nixos/services/remote-builder.nix
-            ./modules/nixos/services/wireguard-client.nix
+        ./modules/nixos/services/wireguard-client.nix
             ./users/gortium/gortium.nix
           ];
         };