feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)

hosts/vps/secrets.nix

@@ -9,4 +9,8 @@
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   sops.secrets.tailscale_authkey = { };
+
+  # darman's console password (own hash = distinct from jupiter/mercury).
+  sops.secrets.darman_password.neededForUsers = true;
+  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
 }