feat: add automatic n8n overlay updates

- overlays/mods/n8n.nix: add passthru.updateScript pointing to ./update.sh
- overlays/mods/update.sh: self-contained updater that fetches the latest
  stable n8n-io/n8n release, recomputes both src and pnpmDeps hashes
  (src via nix-prefetch-url with --name workaround for the `@` in the tag,
  pnpmDeps via the lib.fakeHash mismatch trick)
- .gitea/workflows/nix-update.yml: discover and run overlays/mods/*/update.sh
  after the pkgs/ loop; verify step skips overlay/* entries (covered by flake check)

The test suite (tests/n8n-overlay-test.nix) forbids exporting a local n8n
package, so the overlay cannot be exposed via pkgs/n8n/ — the workflow gets
an explicit overlay-discovery block instead.

overlays/mods/n8n.nix

@@ -39,6 +39,11 @@ in
         fi
       '';
 
+    # Self-contained update script (./update.sh) — fetches latest stable
+    # release from n8n-io/n8n, recomputes both src and pnpmDeps hashes.
+    # The CI workflow in .gitea/workflows/nix-update.yml discovers and runs it.
+    passthru = (previousAttrs.passthru or {}) // {updateScript = ./update.sh;};
+
     meta =
       previousAttrs.meta
       // {