feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)

.sops.yaml

@@ -12,6 +12,9 @@ keys:
   # (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
   - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
   - &vps age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
+  # mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
+  # the private key is dropped on its boot partition after flashing.
+  - &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
 # Each host's secrets go to admin (edit) + that host only. Order matters:
 # the first matching rule wins, so keep these specific paths.
 creation_rules:
@@ -21,3 +24,6 @@ creation_rules:
   - path_regex: secrets/vps\.yaml$
     key_groups:
       - age: [ *admin, *vps ]
+  - path_regex: secrets/mercury\.yaml$
+    key_groups:
+      - age: [ *admin, *mercury ]