homelab-deploy: add NATS-based deployment system

Add homelab-deploy flake input and NixOS module for message-based
deployments across the fleet. Configure DEPLOY account in NATS with
tiered access control (listener, test-deployer, admin-deployer).
Enable listener on vaulttest01 as initial test host.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

hosts/vaulttest01/configuration.nix

@@ -101,6 +101,22 @@ in
     services = [ "vault-test" ];
   };
 
+  # Homelab-deploy listener NKey
+  vault.secrets.homelab-deploy-nkey = {
+    secretPath = "shared/homelab-deploy/listener-nkey";
+    extractKey = "nkey";
+  };
+
+  # Enable homelab-deploy listener
+  services.homelab-deploy.listener = {
+    enable = true;
+    tier = "test";
+    role = "vault";
+    natsUrl = "nats://nats1.home.2rjus.net:4222";
+    nkeyFile = "/run/secrets/homelab-deploy-nkey";
+    flakeUrl = "git+https://git.t-juice.club/torjus/nixos-servers.git";
+  };
+
   # Create a test service that uses the secret
   systemd.services.vault-test = {
     description = "Test Vault secret fetching";