feat: AtroPIM deployment config for AZ-PRM-1 (AZ-NIX-ava.2)

- port registry: atrocore = 3058
- oci-container atrocore: Gitea-registry image, 127.0.0.1:3058:80,
  web network, static ip 10.89.0.16, db alias to host pg, env-file
  from agenix, named volume for instance data, registry login via
  token secret
- agenix secrets: atrocore-env (ATRO_DB_*) + atrocore-registry-token,
  age-encrypted to AZ-PRM-1 + user, non-interactive creation
- host postgres 17: idempotent atrocore-db-init oneshot (psql peer,
  secret only at runtime), pg_hba 10.89.0.0/24 scram-sha-256,
  atrocore in 03:10 backup list
- traefik: pim.l.az-gruppe.com -> localhost:3058 (ionos, websecure)

secrets/atrocore-env.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 lGqVZg u2jO08V1k+GAeuVxEfjx1X6kztQQ5UGWYrikR8TG1UM
+3eZXQx5S33KYsqBSem1t11EZ6RuxlENm4f4uRpvG8ZA
+-> ssh-ed25519 CSMyhg gOz1bLWGIN4Q63YXAKjjZo11tcN77U1gG8Isj0EE0DA
+DbV8RnBf7VQ24LKXDiKUxqXh8jrpz+RPajKkzjlzjjU
+--- HgpaS/Vnh/Cv4BzJPUqhqWB+WPPMkJzXN1EpjYa3W4Q
+IÀ5ÛÞ­Ø»v**}TÉ�ÀÃ
+=X	Lçß²7í^§Ç„ŒËÁ^¾7¸Á/®0ÕL‘,<ÕÏKߨ,“mâu‹œê#Ê�½KcJ©ª`ÆŠÅ&H�éï
 Òvl¹*"­�e­I+4ƒ�,Ðá´•r>ôðrw	&i€öd›�