orion: enable sift P1 (pin fac1462)

Add the sift flake input at fac1462e7b3deb2082c9f6ae8dc4676fddf8d089
(git+ssh; git+https cannot auth on orion) and enable services.sift on
orion: loopback :8890, tailscale serve :8443 from the module, static
home WAN /32 in denyPrefixes. Keys stay on-box.

hw/orion/default.nix

@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{ pkgs, inputs, ... }:
 {
   imports = [
     ./hardware-configuration.nix
     # orion started as a desktop with an interactive installer;
     # the disk is already provisioned.
     # ./disk-config.nix
+    inputs.sift.nixosModules.sift
   ];
 
   config = {
@@ -75,5 +76,11 @@
         ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes 8888";
       };
     };
+
+    services.sift = {
+      enable = true;
+      listen = "127.0.0.1:8890";
+      denyPrefixes = [ "99.73.161.224/32" ];
+    };
   };
 }