Replace Docker containers with native NixOS modules for nginx, Authelia, and go2rtc

- Native nginx with ACME wildcard cert (*.nordhammer.it) via Cloudflare DNS-01
- Native Authelia SSO with forward auth protecting homepage + camera
- Native go2rtc camera streaming (no more Docker)
- Auto-migration script for Authelia secrets and user database from Docker
- Homepage hrefs updated to use HTTPS domain names
- Fail2ban updated for native nginx log paths + new Authelia jail

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

common.nix

@@ -30,6 +30,7 @@
     ./services/bazarr.nix
     ./services/cloudflare-ddns.nix
     ./services/fail2ban.nix
+    ./services/authelia.nix
     ./services/homepage.nix
     ./services/arr-interconnect.nix
   ];