Initial infra scaffold: watcher live on Infomaniak Public Cloud

- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
  nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
  via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
  SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
  lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
  keypair, compute instance booted from the uploaded image. Auth via OS_*
  env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
  in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.

Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Provision (or update) the watcher instance via OpenTofu, then push the
+# latest flake config with nixos-rebuild.
+#
+# Prereqs:
+#   - Watcher image already uploaded to Glance (run scripts/build-image.sh once)
+#   - Run inside `nix develop` (auto-sources terraform/infomaniak/.env)
+#
+# Idempotent: safe to re-run.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+: "${OS_AUTH_URL:?terraform/infomaniak/.env not loaded — run inside 'nix develop'}"
+: "${TF_VAR_ssh_public_key:?TF_VAR_ssh_public_key missing — paste pubkey into .env}"
+
+echo "==> tofu apply"
+pushd terraform/infomaniak >/dev/null
+tofu init -upgrade
+tofu apply -auto-approve
+IPV4=$(tofu output -raw watcher_ipv4)
+popd >/dev/null
+
+echo "==> watcher at $IPV4"
+
+echo "==> waiting for SSH"
+for _ in $(seq 1 60); do
+  if ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=3 \
+       -o BatchMode=yes tyro@"$IPV4" true 2>/dev/null; then
+    break
+  fi
+  sleep 2
+done
+
+echo "==> nixos-rebuild switch"
+nixos-rebuild switch \
+  --flake "$REPO_ROOT#watcher" \
+  --target-host "tyro@$IPV4" \
+  --use-remote-sudo
+
+echo
+echo "Done."
+echo "  ssh tyro@$IPV4"