refactor(ssh): drop no-op openFirewall

It is already the sshd module default, and the shared firewall forces
allowedTCPPorts to [ ] anyway; toplevel drvPaths are unchanged.

Assisted-by: Claude Code (claude-opus-5-5)

modules/nixos/base/ssh.nix

@@ -17,7 +17,6 @@
       # nixpkgs defaults it to true, and PAM then still accepts the Unix password
       KbdInteractiveAuthentication = false;
     };
-    openFirewall = true;
     # Only keys declared in Nix log in; a hand- or intruder-added key is ignored
     authorizedKeysInHomedir = false;
   };