Assert against proxy.ssl with the default domain "localhost"

proxy.ssl = true (the default) requests a real ACME certificate for
services.hortusfox-web.domain. Left at its own default of "localhost",
that request can never succeed -- Let's Encrypt won't issue for it --
but previously this only surfaced as an ACME failure at activation
time. Catch it at eval time instead with a clear assertion message.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nixos-module/default.nix

@@ -273,6 +273,20 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.proxy.ssl && cfg.domain == "localhost");
+        message = ''
+          services.hortusfox-web: proxy.ssl = true (the default) requests an
+          ACME certificate for services.hortusfox-web.domain, but domain is
+          left at its own default of "localhost" -- Let's Encrypt can never
+          issue a certificate for that, so this would only fail at runtime.
+          Set domain to a real, publicly resolvable FQDN, or set
+          proxy.ssl = false for a local/test deployment.
+        '';
+      }
+    ];
+
     users.users.${cfg.user} = {
       isSystemUser = true;
       group = cfg.group;