add opencrow Matrix bot on ful

Uses upstream NixOS module (systemd-nspawn container with sandboxing).

- User: @fable:4d2.org on matrix.4d2.org
- Provider: GitHub Copilot (OAuth, one-time interactive login)
- Secrets via agenix: matrix token as environmentFile,
  soul bind-mounted into the container
- Sessions + pi-agent state in /var/lib/opencrow, backed up via restic

To complete setup:
1. Create secrets/opencrow-matrix-token.age (OPENCROW_MATRIX_ACCESS_TOKEN=...)
2. Create secrets/opencrow-soul.age (SOUL.md content)
3. One-time Copilot login inside the container:
   sudo nixos-container root-login opencrow
   PI_CODING_AGENT_DIR=/var/lib/opencrow/pi-agent pi
   # Run /login, select GitHub Copilot, complete OAuth flow

secrets.txt

@@ -61,6 +61,8 @@ secrets/nextcloud-password-database.age
 secrets/nextcloud-password-fysi.age
 secrets/nextcloud-password-kieran.age
 secrets/onlyoffice-jwt-key.age
+secrets/opencrow-matrix-token.age
+secrets/opencrow-soul.age
 secrets/openweathermap-api-key.age
 secrets/restic.age
 secrets/secrets.nix