migrate: stow → chezmoi

- restructure repo to chezmoi conventions (dot_ prefix, private_dot_ssh/)
- add nvim config (was untracked)
- encrypt restic pass.txt with age
- remove stow artifacts (.stow-local-ignore, stow package dirs)
- update bootstrap.sh to use chezmoi apply
- remove runtime files from tracking (micro buffers, zed backup)

.gitignore

@@ -33,3 +33,8 @@
 
 micro/.config/micro/backups
 micro/.config/micro/buffers
+**/settings_backup.json
+
+# override global gitignore — these belong in dotfiles
+!CLAUDE.md
+!AGENTS.md