feat: AtroPIM image pipeline with secret-free build (AZ-NIX-ava.1)

- flake input atrocore-docker rev-pinned (e1e9bed)
- pkgs/atropim-image: atropim-build/atropim-push scripts + 2-stage
  podman build (vendor pdf target + entrypoint wrapper)
- entrypoint writes ATRO_DB_* to data/config.php at runtime,
  guarded by isInstalled (idempotent); no DB credentials in layers
- devShell documents build/push commands and ENV variables

pkgs/default.nix

@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  atrocore-docker,
+  ...
+}: {
   # Define your custom packages here
   online3dviewer = pkgs.callPackage ./online3dviewer {};
+  atropim-tools = pkgs.callPackage ./atropim-image {inherit atrocore-docker;};
 }