neptun: add Zitadel (identity/OIDC provider)

Local Postgres, peer-authed over the unix socket (the "zitadel" role is
granted createdb+createrole and doubles as both the runtime and bootstrap
DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens
on localhost:8080 and is proxied at auth.mgaction.town.

Master key and admin bootstrap password come from sops - the admin
password specifically needs the sops.templates -> rendered-file route
(services.zitadel.steps would leak it into the world-readable Nix store),
same pattern as mercury's pihole.env.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/secrets.nix

@@ -13,4 +13,27 @@
   # darman's console password (own hash = distinct from jupiter/mercury).
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
+
+  # Zitadel: masterKeyFile takes a path natively (no store leak). The admin
+  # bootstrap password is different — services.zitadel.steps would render it
+  # into a world-readable store path, so render a FirstInstance steps file
+  # from the secret instead and point extraStepsPaths at it (see
+  # services/zitadel.nix and the pihole.env template on mercury for the same
+  # pattern).
+  sops.secrets.zitadel_master_key = { };
+  sops.secrets.zitadel_admin_password = { };
+  sops.templates."zitadel-first-instance.yaml".content = ''
+    FirstInstance:
+      Org:
+        Name: mgaction
+        Human:
+          UserName: admin
+          FirstName: Admin
+          LastName: Admin
+          Email:
+            Address: erik.simon.me@gmail.com
+            Verified: true
+          Password: ${config.sops.placeholder.zitadel_admin_password}
+          PasswordChangeRequired: false
+  '';
 }