feat: implement NATS-based NixOS deployment system

Implement the complete homelab-deploy system with three operational modes:

- Listener mode: Runs on NixOS hosts as a systemd service, subscribes to
  NATS subjects with configurable templates, executes nixos-rebuild on
  deployment requests with concurrency control

- MCP mode: MCP server exposing deploy, deploy_admin, and list_hosts
  tools for AI assistants with tiered access control

- CLI mode: Manual deployment commands with subject alias support via
  environment variables

Key components:
- internal/messages: Request/response types with validation
- internal/nats: Client wrapper with NKey authentication
- internal/deploy: Executor with timeout and lock for concurrency
- internal/listener: Subject template expansion and request handling
- internal/cli: Deploy logic with alias resolution
- internal/mcp: MCP server with mcp-go integration
- nixos/module.nix: NixOS module with hardened systemd service

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/cli/aliases.go

@@ -0,0 +1,40 @@
+// Package cli provides the deploy command logic.
+package cli
+
+import (
+	"os"
+	"strings"
+)
+
+const aliasEnvPrefix = "HOMELAB_DEPLOY_ALIAS_"
+
+// ResolveAlias resolves a subject alias to a full NATS subject.
+// If the input looks like a NATS subject (contains dots), it is returned as-is.
+// Otherwise, it checks for an environment variable HOMELAB_DEPLOY_ALIAS_<NAME>.
+// Alias names are case-insensitive and hyphens are converted to underscores.
+func ResolveAlias(input string) string {
+	// If it contains dots, it's already a subject
+	if strings.Contains(input, ".") {
+		return input
+	}
+
+	// Convert to uppercase and replace hyphens with underscores
+	envName := aliasEnvPrefix + strings.ToUpper(strings.ReplaceAll(input, "-", "_"))
+
+	if alias := os.Getenv(envName); alias != "" {
+		return alias
+	}
+
+	// Return as-is if no alias found (will likely fail later)
+	return input
+}
+
+// IsAlias returns true if the input looks like an alias (no dots).
+func IsAlias(input string) bool {
+	return !strings.Contains(input, ".")
+}
+
+// GetAliasEnvVar returns the environment variable name for a given alias.
+func GetAliasEnvVar(alias string) string {
+	return aliasEnvPrefix + strings.ToUpper(strings.ReplaceAll(alias, "-", "_"))
+}