nixos/portcullis: Add initial config

New bare-metal box headed for Nikhef, intended to take over most of
estuary's colony edge routing. This is the bootstrap config only: the
hardware, the single-NVMe ESP + LVM layout, and enough networking to
boot and be reachable.

It is being staged at home before it is racked, so it has no colony
assignments yet. Every 2.5G port takes DHCP and whichever one is
patched in brings the box up; kea registers the DHCP hostname, so the
deploy node points at portcullis.dyn.h.nul.ie until there is a real
colony FQDN for it.

The host key was adopted from the installer session and seeded onto
the persist volume before first boot, so my.secrets.key could be set
up front -- which makes portcullis a recipient of the user-passwd
secret that my.user declares for every box.

Documented with a box page, a row in the colony site index, and a note
in the colony section of networking.md that the topology is expected
to change once portcullis takes over from estuary.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/networking.md

@@ -266,6 +266,10 @@ On top of that: `p2pTunnels` (`10.100.5.0/24`) holds point-to-point tunnel /30s
 public blocks and the per-customer `mail` / `darts` / `jam` prefixes carry customer-facing
 services with their own public addresses (announced by BGP, routed via the host).
 
+This layout is expected to change: [`portcullis`](sites/colony/portcullis.md) is bare-metal edge
+hardware headed for Nikhef that will take over most of `estuary`'s routing. It has no assignments
+yet and the replacement topology is still being designed.
+
 ## home
 
 The home site prefixes (`lib.my.c.home.prefixes`) come from `192.168.64.0/18` and