Initial infra scaffold: watcher live on Infomaniak Public Cloud

- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
  nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
  via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
  SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
  lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
  keypair, compute instance booted from the uploaded image. Auth via OS_*
  env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
  in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.

Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/build-image.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Build the watcher's NixOS QCOW2 image and upload it to Infomaniak Glance.
+#
+# Prereqs:
+#   - Run inside `nix develop` (provides openstackclient + nix + flakes).
+#   - terraform/infomaniak/.env populated and auto-sourced by the devShell.
+#   - SSH pubkey pasted into hosts/watcher/default.nix.
+#
+# Re-run any time the watcher's NixOS config changes if you want fresh boots
+# from a current image. Routine config updates after boot use nixos-rebuild
+# instead (no image rebuild required).
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+IMAGE_NAME="${TF_VAR_watcher_image_name:-nixos-watcher}"
+
+: "${OS_AUTH_URL:?terraform/infomaniak/.env not loaded — run inside 'nix develop'}"
+
+echo "==> building QCOW2 (this takes a few minutes the first time)"
+nix build .#watcher-image
+
+# nixos-generators names the file with the channel revision, e.g.
+#   nixos-image-openstack-25.05.20260102.ac62194-x86_64-linux.qcow2
+QCOW=$(ls "$(readlink -f result)"/*.qcow2 | head -1)
+[ -f "$QCOW" ] || { echo "no qcow2 found under result/" >&2; exit 1; }
+ls -lh "$QCOW"
+
+echo "==> uploading to Infomaniak Glance as '$IMAGE_NAME'"
+# If an older copy exists, delete it first (Glance image names aren't unique).
+if openstack image show "$IMAGE_NAME" -f value -c id >/dev/null 2>&1; then
+  echo "    older image found — deleting"
+  openstack image delete "$IMAGE_NAME"
+fi
+
+openstack image create \
+  --disk-format qcow2 \
+  --container-format bare \
+  --file "$QCOW" \
+  --progress \
+  "$IMAGE_NAME"
+
+echo "==> done. Image:"
+openstack image show "$IMAGE_NAME" -f table -c id -c name -c status -c size