manatee: add self-hosted todo app

Wire the offline-first todo app (github: local /home/alex/code/todo) into
manatee, following the app-module convention:

- flake input `todo` (local git checkout for now; gitea URL commented) with
  nixpkgs following.
- hosts/manatee/modules/todo: mod.todo option importing the app's NixOS module;
  runs on 127.0.0.1:8091, secureCookies, token from agenix; the host owns the
  nginx vhost (todo.ppp.pm, forceSSL + useACMEHost) and homepage card.
- mod.todo.enable = true.
- certs: todo.ppp.pm DNS-01 cert via hetzner.
- home-assistant DNS updater: add `todo` to the Hetzner subdomain list.
- secrets: todo-token.age (encrypted access token) + recipients in secrets.nix.

flake.lock

@@ -877,11 +877,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784906229,
-        "narHash": "sha256-9ZzpwieFwushXgbZZj1W4i8uhI0dmLZCcQSb6qVhn18=",
+        "lastModified": 1785677859,
+        "narHash": "sha256-ZXWSL0F1ZDzeLSXFGvRom89nOEq80gXghc+ky/qA/l8=",
         "ref": "main",
-        "rev": "374e630d8fd0fa063753ffaa3537ada4fb4bc11e",
-        "revCount": 55,
+        "rev": "f9894abfc9cd9c2a5dacb9fe3609b58f5d407392",
+        "revCount": 69,
         "type": "git",
         "url": "ssh://gitea@git.ppp.pm:1122/alex/puppy-tracker.git"
       },
@@ -911,6 +911,7 @@
         "pppdotpm-site": "pppdotpm-site",
         "puppy-tracker": "puppy-tracker",
         "solo-referee": "solo-referee",
+        "todo": "todo",
         "whib-backend": "whib-backend",
         "whib-frontend": "whib-frontend"
       }
@@ -1042,6 +1043,27 @@
         "type": "github"
       }
     },
+    "todo": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786622639,
+        "narHash": "sha256-q28DCpRkhuFcysdWNio4mIsR5VlonXbM8G+DyxitRPo=",
+        "ref": "main",
+        "rev": "a43e443720c3cc3fc38e9367bdac32e6f046c238",
+        "revCount": 17,
+        "type": "git",
+        "url": "file:///home/alex/code/todo"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "file:///home/alex/code/todo"
+      }
+    },
     "whib-backend": {
       "inputs": {
         "nixpkgs": [