feat(mx): add ntfy-sh push notification service

Self-hosted at ntfy.hoyer.xyz with deny-all default access.
After deploying, create a user with: ntfy user add --role=admin harald

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

systems/x86_64-linux/mx/ntfy.nix

@@ -0,0 +1,21 @@
+{ ... }:
+{
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      base-url = "https://ntfy.hoyer.xyz";
+      behind-proxy = true;
+      auth-default-access = "deny-all";
+    };
+  };
+
+  services.nginx.virtualHosts."ntfy.hoyer.xyz" = {
+    useACMEHost = "hoyer.xyz";
+    enableACME = false;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:2586";
+      proxyWebsockets = true;
+    };
+  };
+}