feat: AtroPIM image pipeline with secret-free build (AZ-NIX-ava.1)

- flake input atrocore-docker rev-pinned (e1e9bed)
- pkgs/atropim-image: atropim-build/atropim-push scripts + 2-stage
  podman build (vendor pdf target + entrypoint wrapper)
- entrypoint writes ATRO_DB_* to data/config.php at runtime,
  guarded by isInstalled (idempotent); no DB credentials in layers
- devShell documents build/push commands and ENV variables

flake.lock

@@ -145,6 +145,23 @@
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       }
     },
+    "atrocore-docker": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1786515722,
+        "narHash": "sha256-17KU/c6l4SEoqM13vdvplI0ENxCHJ65SyG0gpzbhyqg=",
+        "owner": "atrocore",
+        "repo": "docker",
+        "rev": "e1e9bed1f6ae983d1aac474657cbeba1c004e313",
+        "type": "github"
+      },
+      "original": {
+        "owner": "atrocore",
+        "repo": "docker",
+        "rev": "e1e9bed1f6ae983d1aac474657cbeba1c004e313",
+        "type": "github"
+      }
+    },
     "azess": {
       "inputs": {
         "nixpkgs": [
@@ -1480,6 +1497,7 @@
       "inputs": {
         "agenix": "agenix",
         "agents": "agents",
+        "atrocore-docker": "atrocore-docker",
         "azess": "azess",
         "azion-scheduler": "azion-scheduler",
         "disko": "disko",