feat: AtroPIM image pipeline with secret-free build (AZ-NIX-ava.1)

- flake input atrocore-docker rev-pinned (e1e9bed)
- pkgs/atropim-image: atropim-build/atropim-push scripts + 2-stage
  podman build (vendor pdf target + entrypoint wrapper)
- entrypoint writes ATRO_DB_* to data/config.php at runtime,
  guarded by isInstalled (idempotent); no DB credentials in layers
- devShell documents build/push commands and ENV variables

overlays/default.nix

@@ -1,7 +1,10 @@
 {inputs, ...}: {
   # This one brings our custom packages from the 'pkgs' directory
   additions = final: prev:
-    (import ../pkgs {pkgs = final;})
+    (import ../pkgs {
+      pkgs = final;
+      atrocore-docker = inputs.atrocore-docker;
+    })
     // {
       zugferd-service = inputs.zugferd-service.packages.${prev.stdenv.hostPlatform.system}.default;
     };