manatee: add self-hosted todo app

Wire the offline-first todo app (github: local /home/alex/code/todo) into
manatee, following the app-module convention:

- flake input `todo` (local git checkout for now; gitea URL commented) with
  nixpkgs following.
- hosts/manatee/modules/todo: mod.todo option importing the app's NixOS module;
  runs on 127.0.0.1:8091, secureCookies, token from agenix; the host owns the
  nginx vhost (todo.ppp.pm, forceSSL + useACMEHost) and homepage card.
- mod.todo.enable = true.
- certs: todo.ppp.pm DNS-01 cert via hetzner.
- home-assistant DNS updater: add `todo` to the Hetzner subdomain list.
- secrets: todo-token.age (encrypted access token) + recipients in secrets.nix.

secrets/manatee/todo-token.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA 11epAkGKr0IpXqtWGQ73rZUsiWQRlL++fc2B2TvQ90M
+lSKGeNiL82UIyhg1wrY9ylltFcITDffJLgA6j02eS2M
+-> ssh-ed25519 +oNaHQ pg1rC56bQRxO2Eb5onV8TkeB/Wsc7HhvufBfslkK+gA
+znYqNOBhQX9bx5k07vVTHye/RLxOAkQ2dCagZWyWBkQ
+--- Dxthx4NFJfe26jFnXH/3NYILME+tlO2FUsSVGCP4ucY
+°]œê&Ì�¥ü…²�+/ªÖ×Dš‘
�ô[6HIÂe>™“‚¾ÛIà Ná
¡1Ak¬’ä4ZHG
+T}o8×f<Û¦r<Â