feat(nix): enable Docker on nemesis

[rrvsh]

Summary

• add a reusable cfg.modules.nixos.docker module to enable Docker and add rafiq to the docker group
• import the Docker module into nix/configs/nemesis.nix so Docker is enabled on the nemesis host
• include a session note documenting implementation and verification (nixos-rebuild switch, docker --version, and hello-world run)