feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)

hosts/mercury/secrets.nix

@@ -0,0 +1,17 @@
+{ config, ... }:
+
+# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
+#
+# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
+# (not ssh-host-key-derived) placed on the FAT boot partition after flashing:
+#   mount the boot partition, copy ~/.config/homelab/mercury/age.txt to it as
+#   sops-age.txt, unmount. The key never enters the repo or the nix store.
+{
+  sops.defaultSopsFile = ../../secrets/mercury.yaml;
+  sops.age.keyFile = "/boot/firmware/sops-age.txt";
+
+  # darman's console password (SSH is key-only regardless). Different hash per
+  # host = different password per host.
+  sops.secrets.darman_password.neededForUsers = true;
+  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
+}