Add nix container build for ntfy

Uses nixpkgs ntfy-sh package instead of the multi-stage Dockerfile build.
After merge, release with: mise run container-tag-and-release ntfy v1.1.0
Then update argocd/manifests/ntfy/deployment.yaml image to the -nix tag.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

containers/ntfy/default.nix

@@ -0,0 +1,27 @@
+# Nix-built ntfy push notification server
+# Replaces the multi-stage Dockerfile (Node + Go + Alpine) with nixpkgs ntfy-sh
+# Built with dockerTools.buildLayeredImage for efficient layer caching
+{ pkgs ? import <nixpkgs> { } }:
+
+pkgs.dockerTools.buildLayeredImage {
+  name = "blumeops/ntfy";
+  tag = "latest";
+
+  contents = [
+    pkgs.ntfy-sh
+    pkgs.cacert
+    pkgs.tzdata
+  ];
+
+  config = {
+    Entrypoint = [ "${pkgs.ntfy-sh}/bin/ntfy" ];
+    Env = [
+      "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      "TZDIR=${pkgs.tzdata}/share/zoneinfo"
+    ];
+    ExposedPorts = {
+      "80/tcp" = { };
+    };
+    User = "65534";
+  };
+}