nixos/security: add acme through dns challenge

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/common.nix

@@ -28,6 +28,8 @@ in
     ./vm.nix
   ];
 
+  age.secrets.ntfy.file = "${self}/agenix/ntfy.age";
+
   nix = {
     package = inputs'.nix-super.packages.default;