HTTP service rendering wallpapers on demand for a location, variant,
overlay and size. Renders stay fresh for 10 minutes; ones that were
picked up are re-rendered in the background when they go stale.
realwallpaper gains --cache-dir so locations share one data cache, and
its cache cleanup now tracks last use instead of fetch time.

Replaces pkgs.realwallpaper (xplanet, dead NASA NEO sources) with a
Python renderer: oblique cylindrical map centred on home with a zoom
lens (or plain/mercator), multi-resolution WMS imagery (Sentinel-2
cloudless, Blue Marble, Black Marble lights), live EUMETSAT clouds with
synthesised detail, VIIRS snow/fire/chlorophyll, sea ice and the sky.

The krebs.realwallpaper module, its nginx config and the mors
fetchWallpaper config are dropped; the tool runs standalone for now.

flake.lock: update

pkgs.phonetpm: 0.4.1 -> 0.4.2

Branches, PRs and auto-merge now use the UPDATE_PKGS_TOKEN repo secret
instead of GITHUB_TOKEN, so the normal pull_request ci.yml run (with the
farm build) shows up on each PR and GitHub merges it with a merge commit
once the ruleset is met. The serial verify job (rebase, dispatch ci.yml,
wait, merge) and the final ci dispatch on master are gone: the auto-merge
counts as the token's, so the push to master triggers ci.yml itself.

UPDATE_PKGS_TOKEN: fine-grained PAT (or GitHub App token) for this repo
with Contents: read/write, Pull requests: read/write and Workflows:
read/write (force-pushing an update branch rebased over master commits that
touched .github/workflows is refused without it). The repo needs "Allow
auto-merge" enabled. The workflow fails early if the secret is missing.