feat: implement NATS-based NixOS deployment system

Implement the complete homelab-deploy system with three operational modes:

- Listener mode: Runs on NixOS hosts as a systemd service, subscribes to
  NATS subjects with configurable templates, executes nixos-rebuild on
  deployment requests with concurrency control

- MCP mode: MCP server exposing deploy, deploy_admin, and list_hosts
  tools for AI assistants with tiered access control

- CLI mode: Manual deployment commands with subject alias support via
  environment variables

Key components:
- internal/messages: Request/response types with validation
- internal/nats: Client wrapper with NKey authentication
- internal/deploy: Executor with timeout and lock for concurrency
- internal/listener: Subject template expansion and request handling
- internal/cli: Deploy logic with alias resolution
- internal/mcp: MCP server with mcp-go integration
- nixos/module.nix: NixOS module with hardened systemd service

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/mcp/server.go

@@ -0,0 +1,61 @@
+package mcp
+
+import (
+	"time"
+
+	"github.com/mark3labs/mcp-go/server"
+)
+
+// ServerConfig holds configuration for the MCP server.
+type ServerConfig struct {
+	NATSUrl         string
+	NKeyFile        string
+	EnableAdmin     bool
+	AdminNKeyFile   string
+	DiscoverSubject string
+	Timeout         time.Duration
+}
+
+// Server wraps the MCP server.
+type Server struct {
+	cfg    ServerConfig
+	server *server.MCPServer
+}
+
+// New creates a new MCP server.
+func New(cfg ServerConfig) *Server {
+	s := server.NewMCPServer(
+		"homelab-deploy",
+		"0.1.0",
+		server.WithToolCapabilities(true),
+	)
+
+	handler := NewToolHandler(ToolConfig{
+		NATSUrl:         cfg.NATSUrl,
+		NKeyFile:        cfg.NKeyFile,
+		AdminNKeyFile:   cfg.AdminNKeyFile,
+		DiscoverSubject: cfg.DiscoverSubject,
+		Timeout:         cfg.Timeout,
+	})
+
+	// Register deploy tool (test-tier only)
+	s.AddTool(DeployTool(), handler.HandleDeploy)
+
+	// Register list_hosts tool
+	s.AddTool(ListHostsTool(), handler.HandleListHosts)
+
+	// Optionally register admin deploy tool
+	if cfg.EnableAdmin {
+		s.AddTool(DeployAdminTool(), handler.HandleDeployAdmin)
+	}
+
+	return &Server{
+		cfg:    cfg,
+		server: s,
+	}
+}
+
+// Run starts the MCP server and blocks until completed.
+func (s *Server) Run() error {
+	return server.ServeStdio(s.server)
+}