orion: enable sift P1 (pin fac1462)

Add the sift flake input at fac1462e7b3deb2082c9f6ae8dc4676fddf8d089
(git+ssh; git+https cannot auth on orion) and enable services.sift on
orion: loopback :8890, tailscale serve :8443 from the module, static
home WAN /32 in denyPrefixes. Keys stay on-box.

flake.lock

@@ -392,6 +392,7 @@
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sgard": "sgard",
+        "sift": "sift",
         "tracker": "tracker"
       }
     },
@@ -437,6 +438,27 @@
         "type": "github"
       }
     },
+    "sift": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790140288,
+        "narHash": "sha256-ZOOKd5X96G5qCDkAZepuOWJ+vyiIHvx6QY+iX0itom0=",
+        "ref": "refs/heads/master",
+        "rev": "fac1462e7b3deb2082c9f6ae8dc4676fddf8d089",
+        "revCount": 12,
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/sift"
+      },
+      "original": {
+        "rev": "fac1462e7b3deb2082c9f6ae8dc4676fddf8d089",
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/sift"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,