Refactor users

NixOS now re-applies the declarative user config (like it should) on
rebuild, even without "users.mutableUsers = false". Comment out password
so that it can be managed with 'passwd', instead of being re-initialized
on every nixos-rebuild.

Also, take advantage of the new isNormalUser option to remove some
lines.