feat(host): atproto-likes web UI at atproto.commoninternet.net

Imports the notplants-atproto module: Docker daemon (this host had none), a
systemd unit running the project's docker-compose stack, and an nginx vhost
proxying to it on 127.0.0.1:8731 with ACME and websocket support.

Opens 80/443 publicly. Until now only 22 was open and everything else was
tailnet-only, so this is a real change in exposure — nginx is now reachable
from the internet. The existing oc.commoninternet.net vhost is untouched and
stays bound to the tailscale IP.

nix/atproto-likes.nix is a COPY; the canonical file lives in the project repo
at /srv/project-orchestrator/projects/notplants-atproto/nix/. Pure evaluation
forbids importing an absolute path outside the flake tree, so it has to be
duplicated here — and a new file must be git-added or nix silently ignores it.

ACME currently FAILS: *.commoninternet.net is a wildcard pointing at
143.244.213.108, so the HTTP-01 challenge is answered by that host (500).
nginx serves a self-signed placeholder and starts fine. Fix is an explicit
A record atproto.commoninternet.net -> 168.119.126.100, then
`systemctl start acme-atproto.commoninternet.net.service`.

Applied with nixos-rebuild switch; container healthy, TLS proxy and wss
verified end to end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmEK2voMnBa23495aLk1Ce

nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix

@@ -9,6 +9,13 @@
 {
   # hardware.nix is the nixos-infect generated hardware-configuration.nix (see README Stage 2a).
 
+  # atproto-likes — the notplants-atproto "most-liked accounts" web UI, served at
+  # atproto.commoninternet.net. Brings in Docker + a compose stack + an nginx vhost
+  # with ACME, and opens 80/443 (previously only 22 was public). Canonical source of
+  # the module is the project repo; ../atproto-likes.nix is a copy kept in this tree
+  # because pure evaluation cannot import a path outside the flake.
+  imports = [ ../../atproto-likes.nix ];
+
   services.openssh = {
     enable = true;
     settings.PermitRootLogin = "yes";