homelab-deploy: add NATS-based deployment system

Add homelab-deploy flake input and NixOS module for message-based
deployments across the fleet. Configure DEPLOY account in NATS with
tiered access control (listener, test-deployer, admin-deployer).
Enable listener on vaulttest01 as initial test host.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

terraform/vault/approle.tf

@@ -89,6 +89,14 @@ locals {
         "secret/data/hosts/nix-cache01/*",
       ]
     }
+
+    # Vault test host with homelab-deploy access
+    "vaulttest01" = {
+      paths = [
+        "secret/data/hosts/vaulttest01/*",
+        "secret/data/shared/homelab-deploy/*",
+      ]
+    }
   }
 }