heather: matrix tuwunel (homeserver) + cinny + tuwunel-admin

- tuwunel arion container: ghcr.io/matrix-construct/tuwunel:v1.7.1,
  server_name=iscg.dev, allow_federation, registration via token.
  Media on Yandex Object Storage (S3) bucket iscg-tuwunel-media.
  Config (tuwunel.toml w/ s3 secret + reg token) bind-mounted from
  /var/lib/tuwunel-secrets/ (outside git, root:docker 0640).
- cinny arion container: ajbura/cinny:latest, config from
  /var/lib/tuwunel-secrets/cinny-config.json, default homeserver iscg.dev.
- tuwunel-admin systemd service: static x86_64 binary (no public docker
  image) at /var/lib/tuwunel-admin/tuwunel-admin, binds 127.0.0.1:8009.
  Caddy admin.iscg.dev terminates TLS.

Fresh install — no users/media migrated from old jul11.

hosts/heather/default.nix

@@ -19,6 +19,7 @@
     ./docker.nix          # docker + arion CLI (контейнеры)
     ./caddy.nix           # edge proxy, TLS, роутинг по доменам
     ./syncthing.nix       # sync + relay
+    ./tuwunel-admin.nix   # matrix admin web UI (systemd, статический бинарник)
   ];
 
   # Arion-проект как systemd-сервис: arion-compose.nix → docker-compose → up.