straylight: drop Tailscale Serve loop for llama on :443

The unit re-applied --https=443 every 5s and fought Mattermost for
that port. llama is served on :10000, managed outside Nix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hw/straylight/default.nix

@@ -200,29 +200,6 @@ in
       };
     };
 
-    # TLS for the llama.cpp API over the tailnet. Clients using
-    # https://straylight.scylla-hammerhead.ts.net/v1 hit Tailscale Serve on
-    # :443, which proxies to llama-server on localhost:11434. Re-apply every
-    # 5s so `tailscale serve reset` cannot leave the API dark.
-    systemd.services.tailscale-serve-llama = {
-      description = "Keep Tailscale HTTPS proxy for llama-server";
-      after = [ "tailscaled.service" "llama-server.service" ];
-      wants = [ "tailscaled.service" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-        RestartSec = "5s";
-        ExecStart = pkgs.writeShellScript "tailscale-serve-llama" ''
-          set -eu
-          while true; do
-            ${pkgs.tailscale}/bin/tailscale serve --bg --https=443 http://127.0.0.1:11434 >/dev/null || true
-            sleep 5
-          done
-        '';
-      };
-    };
-
     # Local ASR: OpenAI-compatible /v1/audio/transcriptions on 11435.
     # CPU-only so it does not contend with llama-server for GTT.
     users.users.whisper-server = {