caddy: wildcard TLS via DNS-01 challenge + ddns-updater for Njalla

Build Caddy with the caddy-dns/njalla plugin to enable DNS-01 ACME
challenges. This issues a single wildcard certificate for
*.sigkill.computer instead of per-subdomain certificates, reducing
Let's Encrypt API calls and certificate management overhead.

Add ddns-updater service (nixpkgs services.ddns-updater) configured
with Njalla provider to automatically update DNS records when the
server's public IP changes.

configuration.nix

@@ -71,6 +71,8 @@
     ./services/mollysocket.nix
 
     ./services/harmonia.nix
+
+    ./services/ddns-updater.nix
   ];
 
   # Hosts entries for CI/CD deploy targets