neptun: add Zitadel (identity/OIDC provider)

Local Postgres, peer-authed over the unix socket (the "zitadel" role is
granted createdb+createrole and doubles as both the runtime and bootstrap
DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens
on localhost:8080 and is proxied at auth.mgaction.town.

Master key and admin bootstrap password come from sops - the admin
password specifically needs the sops.templates -> rendered-file route
(services.zitadel.steps would leak it into the world-readable Nix store),
same pattern as mercury's pihole.env.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -9,6 +9,7 @@
     ../../common.nix              # shared base: user / ssh / nix / firewall
     ../../services/caddy.nix
     ../../services/tailscale.nix
+    ../../services/zitadel.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -48,6 +49,14 @@
   '';
   # TODO: port your other VPS services' vhosts here before deploying.
 
+  # ---- Zitadel (identity/OIDC provider) ----
+  # Runs locally on neptun (see services/zitadel.nix); Caddy just terminates
+  # TLS and proxies to it.
+  services.zitadel.settings.ExternalDomain = "auth.mgaction.town";
+  services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
+    reverse_proxy http://localhost:8080
+  '';
+
   # ---- Gitea SSH forward ----
   # Caddy only proxies HTTP; git-over-ssh needs a raw TCP forward. Gitea's
   # own built-in SSH server runs on jupiter:2222 (see services/gitea.nix —