houses: nightly Kamernet + Vesteda scraper, dedupe by address, owner-only /trackers/houses

- scripts/house-scrape.ts: polite nightly scrape (honest UA, 6-10 s apart, stops a source on 403/challenge), ingest + price history + removals, ntfy alerts on a separate topic (max 5 + summary, first run seeds)
- address_key + duplicate_of: copies on another source link to one listing, manual wins
- /projects/house-tracker -> /trackers/houses (308), owner only (404 otherwise); filters for min m2, rooms, source, Gouda region default; notes, add-by-hand form, total rent, also-on links
- scripts/house-db.sh: run the house-listing CLI as the limited house_cli role
- deploy/systemd/house-scrape.{service,timer}

scripts/house-db.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Run a house-tracker script against prod with the limited house_cli role
+# (house.listings + house.price_history only), without the app's credentials.
+#   scripts/house-db.sh list --city gouda
+#   scripts/house-db.sh add --street "Raam 12" --city Gouda --price 1475
+# Credentials: ~/.config/house-cli.env (DB_URL=..., mode 600, readable by stan only).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+env_file="${HOUSE_CLI_ENV:-$HOME/.config/house-cli.env}"
+[ -r "$env_file" ] || { echo "missing $env_file" >&2; exit 1; }
+unset DATABASE_URL DB_URL
+exec bun --env-file="$env_file" scripts/house-listing.ts "$@"