manatee: add self-hosted todo app

Wire the offline-first todo app (github: local /home/alex/code/todo) into
manatee, following the app-module convention:

- flake input `todo` (local git checkout for now; gitea URL commented) with
  nixpkgs following.
- hosts/manatee/modules/todo: mod.todo option importing the app's NixOS module;
  runs on 127.0.0.1:8091, secureCookies, token from agenix; the host owns the
  nginx vhost (todo.ppp.pm, forceSSL + useACMEHost) and homepage card.
- mod.todo.enable = true.
- certs: todo.ppp.pm DNS-01 cert via hetzner.
- home-assistant DNS updater: add `todo` to the Hetzner subdomain list.
- secrets: todo-token.age (encrypted access token) + recipients in secrets.nix.

flake.nix

@@ -98,6 +98,15 @@
       # url = "path:/home/alex/code/solo-referee";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    todo = {
+      # Not yet pushed to gitea; using the local git checkout for now (git+file
+      # respects .gitignore, so web/node_modules isn't copied into the store).
+      # Flip these once the repo is published, matching the other apps above.
+      # url = "git+ssh://gitea@git.ppp.pm:1122/alex/todo.git?ref=main";
+      url = "git+file:///home/alex/code/todo?ref=main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =