feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)

hosts/mercury/configuration.nix

@@ -6,6 +6,7 @@
 {
   imports = [
     ../../common.nix           # shared base: user / ssh / nix / firewall
+    ./secrets.nix              # sops-nix: darman password (age key on boot part.)
     ../../services/unbound.nix      # local recursive resolver (127.0.0.1:5335)
     ../../services/adguardhome.nix   # DNS adblock + DHCP, forwards to unbound
   ];