feat: AtroPIM image pipeline with secret-free build (AZ-NIX-ava.1)

- flake input atrocore-docker rev-pinned (e1e9bed)
- pkgs/atropim-image: atropim-build/atropim-push scripts + 2-stage
  podman build (vendor pdf target + entrypoint wrapper)
- entrypoint writes ATRO_DB_* to data/config.php at runtime,
  guarded by isInstalled (idempotent); no DB credentials in layers
- devShell documents build/push commands and ENV variables

flake.nix

@@ -70,6 +70,12 @@
       url = "git+https://git.az-gruppe.com/AZ-Intec-GmbH/phishboard.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    atrocore-docker = {
+      # Rev-pinned vendor Dockerfiles for the AtroPIM image pipeline (AZ-NIX-ava.1)
+      url = "github:atrocore/docker/e1e9bed1f6ae983d1aac474657cbeba1c004e313";
+      flake = false;
+    };
   };
 
   outputs = {
@@ -90,8 +96,11 @@
     ];
     forAllSystems = nixpkgs.lib.genAttrs systems;
   in {
-    packages =
-      forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
+    packages = forAllSystems (system:
+      import ./pkgs {
+        pkgs = nixpkgs.legacyPackages.${system};
+        atrocore-docker = inputs.atrocore-docker;
+      });
     overlays = let
       all = import ./overlays {inherit inputs;};
     in
@@ -116,6 +125,7 @@
           opencode
           # pi-coding-agent
           inputs.agenix.packages.${system}.default
+          outputs.packages.${system}.atropim-tools
         ];
 
         shellHook = ''
@@ -140,6 +150,19 @@
           echo "  - ls .opencode-rules/      Browse available rules"
           echo "  - nix develop              Re-enter this shell"
           echo ""
+          echo "🐘 AtroPIM Image Pipeline (AZ-NIX-ava)"
+          echo "  Commands:"
+          echo "    atropim-build            Build secret-free AtroPIM image (podman, 2 stages)"
+          echo "    atropim-push [version]   Tag + push to Gitea registry (default tag: YYYYMMDD)"
+          echo "  Build parameters (pkgs/atropim-image/default.nix):"
+          echo "    SKELETON_VARIANT=pim-no-demo  BUILD_VARIANT=pdf  PRODUCTION_STABILITY=stable"
+          echo "    PRODUCTION_DOMAIN=pim.l.az-gruppe.com  DB build args deliberately EMPTY"
+          echo "  Runtime ENV (written to data/config.php at container start):"
+          echo "    ATRO_DB_HOST  ATRO_DB_NAME  ATRO_DB_USER  ATRO_DB_PASSWORD"
+          echo "  Registry: git.az-gruppe.com/az-intec-gmbh/atrocore-web (podman login git.az-gruppe.com)"
+          echo "  Quick test:"
+          echo "    podman run -d --name atropim -p 127.0.0.1:8080:80 <image>"
+          echo ""
           echo "Remember to add to .gitignore:"
           echo "  .opencode-rules"
           echo "  coding-rules.json"