feat(hetzner): add Stalwart, restic backups, and virtualcam

servers/hetzner/hosts/hetzner/default.nix

@@ -13,13 +13,15 @@
     ../../modules/services/fail2ban.nix
     ../../modules/services/vaultwarden.nix
     ../../modules/services/mailserver.nix
-    ../../modules/services/snappymail.nix
     ../../modules/services/rustdesk.nix
     ../../modules/services/wrxproxy.nix
     ../../modules/services/watchtower.nix
     ../../modules/services/tlsa-updater.nix
     ../../modules/services/shkeeper.nix
     ../../modules/services/backup.nix
+    ../../modules/services/stalwart.nix
+    ../../modules/services/virtualcam.nix
+    ../../modules/system/opencode.nix
   ];
 
   # Only 4GB RAM — limit nix builds to one core at a time to avoid OOM

servers/hetzner/hosts/hetzner/dns-zone.nix

@@ -2,7 +2,7 @@
 # This is the authoritative DNS zone served by CoreDNS
 # Update serial number on changes
 {
-  serial = "2026071003";
+  serial = "2026071004";
   adminEmail = "abuse.severijnse.eu";
   nameservers = ["ns1.severijnse.eu" "ns2.severijnse.eu"];
   ipv4 = "49.13.92.205";

servers/hetzner/hosts/hetzner/hardware.nix

@@ -17,7 +17,7 @@
   swapDevices = [
     {
       device = "/swap";
-      size = 8192;
+      size = 4096;
     }
   ];