feat: AtroPIM deployment config for AZ-PRM-1 (AZ-NIX-ava.2)

- port registry: atrocore = 3058
- oci-container atrocore: Gitea-registry image, 127.0.0.1:3058:80,
  web network, static ip 10.89.0.16, db alias to host pg, env-file
  from agenix, named volume for instance data, registry login via
  token secret
- agenix secrets: atrocore-env (ATRO_DB_*) + atrocore-registry-token,
  age-encrypted to AZ-PRM-1 + user, non-interactive creation
- host postgres 17: idempotent atrocore-db-init oneshot (psql peer,
  secret only at runtime), pg_hba 10.89.0.0/24 scram-sha-256,
  atrocore in 03:10 backup list
- traefik: pim.l.az-gruppe.com -> localhost:3058 (ionos, websecure)

secrets/atrocore-registry-token.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 lGqVZg Nw/1hxgS6OXDgrggZJ9OM3Zhh/CZQCGA6HFZU/ttlD8
+noQd0Q3YpZFuZrvMUj/Qq6/U5OGrTYqeysKRiSnO9c8
+-> ssh-ed25519 CSMyhg HVJKkw9qSoik1lCML+jl0cFGpjRw+8enFp3JeabVnyw
+R27JjwWmQadjJEGeEzej9YR6xlvOcok3GVbIvbFH/9A
+--- rEC1x5+HR0Uro49upploOR7kmMeFQ4jC93+fs9NY9h8
+÷ýƒ%
+Íܯ1Ï\üäXd.šZ3~u‹£¿'šûG º^$¨Ììëön‹5/SÑÅìã�9ž€ØŠ%F	ÉÿóÑ5ç‰�·