neptun: add Zitadel (identity/OIDC provider)

Local Postgres, peer-authed over the unix socket (the "zitadel" role is
granted createdb+createrole and doubles as both the runtime and bootstrap
DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens
on localhost:8080 and is proxied at auth.mgaction.town.

Master key and admin bootstrap password come from sops - the admin
password specifically needs the sops.templates -> rendered-file route
(services.zitadel.steps would leak it into the world-readable Nix store),
same pattern as mercury's pihole.env.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/zitadel.nix

@@ -0,0 +1,62 @@
+{ config, ... }:
+
+# Zitadel — self-hosted identity/OIDC provider. Local Postgres (peer-authed
+# over the unix socket, no password anywhere) since Zitadel is latency-
+# sensitive to its DB. TLS is terminated at Caddy (see the host's
+# configuration.nix for the public vhost); Zitadel itself only listens on
+# localhost:8080.
+#
+# The "zitadel" Postgres role doubles as both Database.postgres.User (normal
+# runtime queries) and .Admin (bootstrap: creates the db/extensions on first
+# start) — granted createdb+createrole instead of using the real postgres
+# superuser, matching Zitadel's own guidance to keep bootstrap privileges
+# scoped to a dedicated role.
+#
+# Needs, wired via sops in the host's secrets.nix:
+#   - masterKeyFile: 32 raw bytes, e.g. `openssl rand -hex 16`
+#   - extraStepsPaths: a FirstInstance admin bootstrap file (keeps the admin
+#     password out of the Nix store — settings.steps would leak it, since
+#     it's rendered into a world-readable store path)
+{
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "zitadel" ];
+    ensureUsers = [
+      {
+        name = "zitadel";
+        ensureDBOwnership = true;
+        ensureClauses = {
+          createdb = true;
+          createrole = true;
+        };
+      }
+    ];
+  };
+
+  services.zitadel = {
+    enable = true;
+    tlsMode = "external";
+    masterKeyFile = config.sops.secrets.zitadel_master_key.path;
+    extraStepsPaths = [ config.sops.templates."zitadel-first-instance.yaml".path ];
+
+    settings = {
+      Port = 8080;
+      ExternalPort = 443;
+      ExternalSecure = true;
+
+      Database.postgres = {
+        Host = "/run/postgresql";
+        Port = 5432;
+        Database = "zitadel";
+        User = {
+          Username = "zitadel";
+          SSL.Mode = "disable";
+        };
+        Admin = {
+          Username = "zitadel";
+          SSL.Mode = "disable";
+        };
+      };
+    };
+  };
+}