feat: implement NATS-based NixOS deployment system

Implement the complete homelab-deploy system with three operational modes:

- Listener mode: Runs on NixOS hosts as a systemd service, subscribes to
  NATS subjects with configurable templates, executes nixos-rebuild on
  deployment requests with concurrency control

- MCP mode: MCP server exposing deploy, deploy_admin, and list_hosts
  tools for AI assistants with tiered access control

- CLI mode: Manual deployment commands with subject alias support via
  environment variables

Key components:
- internal/messages: Request/response types with validation
- internal/nats: Client wrapper with NKey authentication
- internal/deploy: Executor with timeout and lock for concurrency
- internal/listener: Subject template expansion and request handling
- internal/cli: Deploy logic with alias resolution
- internal/mcp: MCP server with mcp-go integration
- nixos/module.nix: NixOS module with hardened systemd service

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/mcp/tools_test.go

@@ -0,0 +1,64 @@
+package mcp
+
+import (
+	"testing"
+	"time"
+)
+
+func TestNewToolHandler(t *testing.T) {
+	cfg := ToolConfig{
+		NATSUrl:         "nats://localhost:4222",
+		NKeyFile:        "/path/to/key",
+		AdminNKeyFile:   "/path/to/admin/key",
+		DiscoverSubject: "deploy.discover",
+		Timeout:         10 * time.Minute,
+	}
+
+	h := NewToolHandler(cfg)
+
+	if h.cfg.NATSUrl != cfg.NATSUrl {
+		t.Errorf("NATSUrl = %q, want %q", h.cfg.NATSUrl, cfg.NATSUrl)
+	}
+	if h.cfg.NKeyFile != cfg.NKeyFile {
+		t.Errorf("NKeyFile = %q, want %q", h.cfg.NKeyFile, cfg.NKeyFile)
+	}
+	if h.cfg.Timeout != cfg.Timeout {
+		t.Errorf("Timeout = %v, want %v", h.cfg.Timeout, cfg.Timeout)
+	}
+}
+
+func TestDeployTool(t *testing.T) {
+	tool := DeployTool()
+
+	if tool.Name != "deploy" {
+		t.Errorf("Name = %q, want %q", tool.Name, "deploy")
+	}
+
+	if tool.Description == "" {
+		t.Error("Description should not be empty")
+	}
+}
+
+func TestDeployAdminTool(t *testing.T) {
+	tool := DeployAdminTool()
+
+	if tool.Name != "deploy_admin" {
+		t.Errorf("Name = %q, want %q", tool.Name, "deploy_admin")
+	}
+
+	if tool.Description == "" {
+		t.Error("Description should not be empty")
+	}
+}
+
+func TestListHostsTool(t *testing.T) {
+	tool := ListHostsTool()
+
+	if tool.Name != "list_hosts" {
+		t.Errorf("Name = %q, want %q", tool.Name, "list_hosts")
+	}
+
+	if tool.Description == "" {
+		t.Error("Description should not be empty")
+	}
+}