Rewrite PIA VPN as multi-container bridge architecture

Replace the single VPN container (veth pair, host-side auth scripts) with a
multi-container setup on a shared bridge network:

- Dedicated VPN container handles all PIA auth, WireGuard config, NAT, and
  optional port forwarding DNAT
- Service containers default-route through VPN container (leak-proof by topology)
- Host runs tinyproxy on bridge for PIA API bootstrap before WG is up
- WG interface is still created in host netns and moved into VPN container
  namespace
- Monthly renewal to ensure that connection stays up (PIA allows connections to
  last up to 2 months)
- Drop OpenVPN support entirely

common/ntfy-alerts.nix

@@ -16,6 +16,12 @@ in
       default = "service-failures";
       description = "ntfy topic to publish alerts to.";
     };
+
+    curlExtraArgs = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = "Extra arguments to pass to curl (e.g. --proxy http://host:port).";
+    };
   };
 
   config = lib.mkIf config.thisMachine.hasRole."ntfy" {
@@ -33,6 +39,7 @@ in
           ${lib.getExe pkgs.curl} \
             --fail --silent --show-error \
             --max-time 30 --retry 3 \
+            ${cfg.curlExtraArgs} \
             -H "Authorization: Bearer $NTFY_TOKEN" \
             -H "Title: Service failure on ${config.networking.hostName}" \
             -H "Priority: high" \