feat: AtroPIM deployment config for AZ-PRM-1 (AZ-NIX-ava.2)

- port registry: atrocore = 3058
- oci-container atrocore: Gitea-registry image, 127.0.0.1:3058:80,
  web network, static ip 10.89.0.16, db alias to host pg, env-file
  from agenix, named volume for instance data, registry login via
  token secret
- agenix secrets: atrocore-env (ATRO_DB_*) + atrocore-registry-token,
  age-encrypted to AZ-PRM-1 + user, non-interactive creation
- host postgres 17: idempotent atrocore-db-init oneshot (psql peer,
  secret only at runtime), pg_hba 10.89.0.0/24 scram-sha-256,
  atrocore in 03:10 backup list
- traefik: pim.l.az-gruppe.com -> localhost:3058 (ionos, websecure)

hosts/AZ-PRM-1/services/postgres.nix

@@ -52,6 +52,7 @@
       # Podman network connections
       host    baserow      baserow      10.89.0.0/24    scram-sha-256
       host    kestra       kestra       10.89.0.0/24    scram-sha-256
+      host    atrocore     atrocore     10.89.0.0/24    scram-sha-256
 
       # Grafana (local socket / localhost only)
       host    grafana      grafana      127.0.0.1/32    scram-sha-256
@@ -65,7 +66,7 @@
   services.postgresqlBackup = {
     enable = true;
     startAt = "03:10:00";
-    databases = ["baserow" "kestra" "n8n" "netbox"];
+    databases = ["atrocore" "baserow" "kestra" "n8n" "netbox"];
   };
   networking.firewall = {
     extraCommands = ''