... so it can be used in the nginx config instead of duplicating the number

As per @jcalderone and @florian videoconf on 2021-08-06.

- Remove custom handling of Let's Encrypt certs, use NixOs' ACME
  integration instead.

- Use NGINX for TLS termination.

This causes NixOS to generate the systemd timer unit for us and saves us
having to explain a lot of subtle systemd features.

It does pin execution to midnight on Monday but scaling to handle load spikes
is Let's Encrypt's problem, I guess.

The nixpkgs fork already contains all of the changes our overlays were
responsible for - but as direct nixpkgs changes instead.

And test for (kind of) SSH availability

The new version of PaymentServer has incompatible changes that require this.

so it won't be running yet when this runs

right???

reordering/reformatting just to make commenting easier

maybe the other systemd timer fires right away too

why make it a plugin, then, you may ask.
or perhaps you may not ask.