feat: implement NATS-based NixOS deployment system

Implement the complete homelab-deploy system with three operational modes:

- Listener mode: Runs on NixOS hosts as a systemd service, subscribes to
  NATS subjects with configurable templates, executes nixos-rebuild on
  deployment requests with concurrency control

- MCP mode: MCP server exposing deploy, deploy_admin, and list_hosts
  tools for AI assistants with tiered access control

- CLI mode: Manual deployment commands with subject alias support via
  environment variables

Key components:
- internal/messages: Request/response types with validation
- internal/nats: Client wrapper with NKey authentication
- internal/deploy: Executor with timeout and lock for concurrency
- internal/listener: Subject template expansion and request handling
- internal/cli: Deploy logic with alias resolution
- internal/mcp: MCP server with mcp-go integration
- nixos/module.nix: NixOS module with hardened systemd service

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CLAUDE.md

@@ -10,41 +10,29 @@ homelab-deploy is a message-based deployment system for NixOS configurations usi
 2. **MCP mode** - MCP server exposing deployment tools for AI assistants
 3. **CLI mode** - Manual deployment commands for administrators
 
-## Build Commands
-
-```bash
-# Enter development shell
-nix develop
-
-# Build the binary
-go build ./cmd/homelab-deploy
-
-# Run tests
-go test ./...
-
-# Build with Nix
-nix build
-```
-
 ## Architecture
 
 ### NATS Subject Structure
 
-Subjects follow `deploy.<tier>.<target>`:
+Default subjects follow `deploy.<tier>.<target>`, but are configurable via template variables:
 - `deploy.<tier>.<hostname>` - Deploy to specific host
 - `deploy.<tier>.all` - Deploy to all hosts in tier
 - `deploy.<tier>.role.<role>` - Deploy to hosts with role in tier
-- `deploy.responses.<request-id>` - Response subject for request/reply
+- `deploy.responses.<uuid>` - Response subject for request/reply
 - `deploy.discover` - Host discovery subject
 
-### Planned Package Structure
+Template variables: `<hostname>`, `<tier>`, `<role>` - expanded at listener startup.
+
+### Package Structure
 
 ```
-cmd/homelab-deploy/main.go    # CLI entrypoint with urfave/cli subcommands
-internal/listener/            # Listener mode (NATS subscription, nixos-rebuild execution)
+cmd/homelab-deploy/main.go    # CLI entrypoint with urfave/cli/v3 subcommands
+internal/messages/            # Shared message types (request, response, enums)
+internal/nats/                # NATS client wrapper with NKey auth
+internal/deploy/              # Deployment execution logic (nixos-rebuild, lock)
+internal/listener/            # Listener mode (NATS subscription, request handling)
+internal/cli/                 # CLI deploy command logic and subject aliases
 internal/mcp/                 # MCP server mode
-internal/nats/                # NATS client wrapper
-internal/deploy/              # Shared deployment execution logic
 nixos/module.nix              # NixOS module for listener service
 ```
 
@@ -63,11 +51,12 @@ Response: `{"hostname": "<name>", "status": "accepted|rejected|started|completed
 
 ## Dependencies
 
-Key Go libraries to use:
+Key Go libraries:
+- `github.com/urfave/cli/v3` - CLI framework
 - `github.com/nats-io/nats.go` - NATS client
+- `github.com/nats-io/nkeys` - NKey authentication
 - `github.com/mark3labs/mcp-go` - MCP server implementation
 
-
 ## Build Commands
 
 Run commands through the Nix development shell using `nix develop -c`: