Same delegation and TSIG key as for *.review.lassul.us, so lego can get
the wildcard cert for PDS handles via DNS-01.

nixpkgs has tranquil-pds 0.6.7 with its frontend and a NixOS module;
this bumps both to the 0.7.0 release. The frontend is passthru.frontend,
for services.tranquil-pds.settings.frontend.dir.

pkgs.calino: 0.39.1 -> 0.40.0

When VictoriaMetrics has no sample shortly before the increase() window
(the monitoring server was down, or the series is new), MetricsQL's
increase() treats the first sample in the window as an increase from 0 and
returns the whole counter. After styx lost power for ~9 minutes, OOMKill
fired for coaxmetal with all 5 OOM kills since its boot 49 days ago,
although the counter never moved.

Only alert when the series has a sample in the minute before the window
(two minutes for the 60s smartctl scrape). Then increase() has a real
previous value, and still handles counter resets on a monitored host's
reboot. increase_pure() does not help: it assumes counters start at 0
and so counts the whole value as well.

NvmeMediaErrors uses increase() on a counter the same way and would
fire for any drive with past media errors after a gap, so it gets the
same guard. MemoryPressure's rate() is not affected: rate() does not
count the first sample in the window as an increase.

Mounts an empty auth_providers list to /config/auth_providers.yaml. homeassistant: auth_providers is read only from configuration.yaml, packages can't set it, so the volume's configuration.yaml includes it once (auth_providers: !include auth_providers.yaml under homeassistant:). Without the homeassistant provider only auth_oidc remains: the welcome page redirects straight to id.lassul.us and no password form is offered.

Long-lived access tokens have no credential and are not checked against a provider, so they keep working. Refresh tokens from earlier password logins fail on the next refresh and need one id.lassul.us login. The password credentials stay in the auth store, so a revert brings the password login back.