pds.lassul.us with handles <name>.pds.lassul.us (wildcard cert via
DNS-01). Login through the zitadel project pds (access = declarative,
only lass@lassul.us), via Tranquil's generic OIDC SSO. Accounts are
created only through the SSO signup, without invite codes; nginx
returns 403 for createAccount, createPasskeyAccount and
createDelegatedAccount (this also blocks migrating accounts in).
SMTP username and SSO_OIDC_ENABLED are set via the environment
because the nixpkgs module validates the config file at build time
without the secrets they require. Mail goes out as send-only
pds@lassul.us, a mailbox on neoprism's mailserver defined next to the
PDS.

Same delegation and TSIG key as for *.review.lassul.us, so lego can get
the wildcard cert for PDS handles via DNS-01.

nixpkgs has tranquil-pds 0.6.7 with its frontend and a NixOS module;
this bumps both to the 0.7.0 release. The frontend is passthru.frontend,
for services.tranquil-pds.settings.frontend.dir.