manatee: add self-hosted todo app

Wire the offline-first todo app (github: local /home/alex/code/todo) into
manatee, following the app-module convention:

- flake input `todo` (local git checkout for now; gitea URL commented) with
  nixpkgs following.
- hosts/manatee/modules/todo: mod.todo option importing the app's NixOS module;
  runs on 127.0.0.1:8091, secureCookies, token from agenix; the host owns the
  nginx vhost (todo.ppp.pm, forceSSL + useACMEHost) and homepage card.
- mod.todo.enable = true.
- certs: todo.ppp.pm DNS-01 cert via hetzner.
- home-assistant DNS updater: add `todo` to the Hetzner subdomain list.
- secrets: todo-token.age (encrypted access token) + recipients in secrets.nix.

hosts/manatee/modules/home-assistant/default.nix

@@ -251,7 +251,7 @@ in
             ];
 
             script = ''
-              SUBDOMAINS="ha komga romm puppy"
+              SUBDOMAINS="ha komga romm puppy todo"
               INTERFACE="enp3s0"
 
               CURRENT_IP=$(curl -s --fail --interface "$INTERFACE" ifconfig.me)