feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)

secrets/mercury.yaml

@@ -0,0 +1,25 @@
+darman_password: ENC[AES256_GCM,data:HzFkwGIyQL1sbPegJq970n3VASkaO/iY1t3fjodqk6FSoGX+4zlVoZfNAuTeiyAwv+0bZHhJoK+cAPKp5HMqsnhXJrhJUV7KVA3beyBXPPg8IpXi4X4maKv9KLIiWi2BJQuE421LUjb/2A==,iv:dcCD3aaEfVfPBh0jwFZkmNz0L/ZfRzMROJIHXd6pkG8=,tag:5vRhPo+fE28HrZPp6ZJ1MQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMXdtQ2E3SENhY2RKWGx1
+            bWVPUUd6K2gwbnRjbjVZZnIvSkJpaW1kNXhNCmF5KzFZdDZoVjcybTIzeEltNk1X
+            QXg4bFJmQkhsUkVpQ1pEVHVUMmN2OWcKLS0tIExKdGwzWTJDbEd4b3V6SlIvSXo0
+            SDZMTXYyZThQamN1YUt2ODRhdm1kdEEK8wZbc4NCgWYJ4tZtq2UxATleAhJxor5b
+            H0Fjcz+V0CesaF1sxR1M1gUe7uXrhdNdNgZvr+aF/+jsKHq+thbelw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNTJkd29HTWdFc1ZhTDFN
+            d2paTy91aGNNSlBWUDdqY255MzN1QUlibldJCmdHY0FVMU1uV2lRUGp0MjVFYjVO
+            RWNsMk0wU2oxaXdlS25TSHJIQnhxMXMKLS0tIG1GRjVSMEgyY2RYZDRSTllVd3g5
+            UGFjMERZTHhuWGpFVUE4TVIyYlA4WmMKcinqjjAaR3hJRLJepZPxunQz9WBvmP6+
+            ZsBrZS0j0B3MhTI+6gUWB82xozgmnh95w+SXSSZZvoss8RuicE5ysA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
+    lastmodified: "2026-07-13T18:50:12Z"
+    mac: ENC[AES256_GCM,data:8e1VHvwPzI97toTrkbT53ky8OV8Jepyn5yhEHq87wcDP4cywZTm6WbJsqJNgvYdwwxIgaLK7WyausaFfnqIBRFSxauhmTD7mjXKwGFAvSyeyFL3RYbdTc3+GInTE8gF8oBQ7OGIREW6pcDFswzhmcTKbJ01V+vJ2sgxnvifNe7E=,iv:pmLsvkPro4aw//UdldKErbYfVmlK+xb2/4CbN0I6gQQ=,tag:sy9wBkTYIdYrlJ8U4TdJIw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

secrets/vps.yaml

@@ -1,25 +1,26 @@
-tailscale_authkey: ENC[AES256_GCM,data:K9An79w/7ZHl3Pb+TYgH1fzFqEsuBjgMqt4O9lS9csY=,iv:I3SWgDQDiWV/ItUs3biU+EG6nzy446Rd2Cf74fJVpVM=,tag:kn3PXvGkcheKF+26jLK3MQ==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:CBMidfdilBn1HP3TAu9TCOpuwPnzVQ/3OGCsf0vhFd8=,iv:V4UdZBPyzH8NkiXV40CxLdnfkCv5oG6xEQbNSmpmrmI=,tag:h8R2AIaFXgPycMIP8NyHVA==,type:str]
+darman_password: ENC[AES256_GCM,data:otLevSn6bXBrjCu7Dv9PN7Umwrb7CD1PhC1i+J8rp2mURMYVuwF/ZnrlPC7/RDZgINIRBOXOkG9lZo3UjuRyqrtvfUzIm1jGL51l1zvZ/07oNW6OUp4IZEQpoOmz1GuXBlx+yKRQeRDHYA==,iv:pnwp3uAsBoiJdF+QV27h0jztgFJKrIqFlmMT7JkcHoA=,tag:Zb9ziCGsLQt+TcJRCv8tWA==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNVRnY1djOFFpQjEzYzdi
-            ZHhjZWliL2xlK2t6MncxSnk3ZW8ybHFNZ0hNCk0wWHdBajlMQWtjU21QQkxSV1M0
-            bzJhbFBSSmdPU2VTV1NyQmhmUnlJUUEKLS0tIHFTTGlIam9MdllGamc2ZVZIaEFL
-            ZkE4cDk0aTdEMGtxVGM3U2JCMFppalEKnyyQCErY7e5pIFoYS6yYq5puqXAUgClJ
-            U9VkM7G1MZV+Z91XTKs63fd2QyV8ITTK82BMpwH39UzdbbU+mqFvqw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUOVhzYzN4ekZtNHF2TGcr
+            VjRITjg4UldQRStoaHhUa0RPODBVUTNETjF3CkljbzRDNytBanlZOEtjcEFMYW1W
+            QThTK1ZGR1plWFVrTThYMk5sU0N3bUkKLS0tIHNYclVIWHhNeGk2QXozdkN3TGdr
+            VWNxK3pYM1IxZW9XU2QwYkVEeEEzUGcK0ZvVWycAfDq4Cb4fVFm40mUTLLuqK6DU
+            S/QUwFEiVAqMixxhS0vXOlovFQI+lzLLtLBi7Evi7ZI/fmdNqvz0+Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZER4Q1NFSVJNUFpMS2JQ
-            dVZseHFzc2lWOXVJQmdIZ2xHeWVDMEYyTFJjCkdKckNQNTZ4Zm9hRCtMc2lMZmFF
-            TTh3cVBMVWJGRGY3Z2ErWlBlQUZhL0EKLS0tIGxGZDIzZEhsSFQ5SmNZblk5eHpy
-            ZWpPU1RNZHNIRUhJMXE0dFFtcTRzUmsKnKzMUXY8MKG2Ilgzg1IIr7hvXuvLvzCH
-            EaWB6C+J7/jG3dXfVTfKlubE7x62XDkWMa8OYMFELke/7GU6XXmHWg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbUtuMHNhblFwTHdjQjIz
+            MjdtL3VsZE5zU21tVTE5NnlBWVRqRDZGblY4Ck1ieUFkRk9tM25NN0pyMmtBWTZJ
+            clhpNnhIQzlwd1VqQ1dzaVBhYjJkVGcKLS0tIFh0b0hvVU9xNVZ6QkNHcCs3UU5C
+            SEhKZEdlVkRyTTNzYUkvZ0JWYS83QjAK+2Shx79sIV2lYzAsRegzCnhScn2i2f/+
+            Wptkf76aP9UpjhgNkxzedRebQPB7ti+UiVqCvLVimtuHcsm/NJPcRg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
-    lastmodified: "2026-07-12T22:59:51Z"
-    mac: ENC[AES256_GCM,data:yS13N11tXN2orKAP2ufRNdJbEGkY+bfZiA/7PwSWtgipIlGvnCKbr6yVqMElfNA39Znu+i1sWtk3FxWjRJQ3rM+uRpEdzoseMnYiHkvK0t5hC1ElBxwUdv8v/1RV5/halTV+5G8/lAd48ejgtnLLCpSbw6nPKrDoxb8/Ma5oaj0=,iv:MejfOs5F7eAmwZPsrLUF+6KPxWgACKKbnn5skCisuBo=,tag:X4BI6zDQgqXnnmCVOl25/A==,type:str]
+    lastmodified: "2026-07-13T18:50:14Z"
+    mac: ENC[AES256_GCM,data:52kyoG1moXQ9rDT7NLbxJby5ZiUn0Gym3u4kuLTsXxlGIvots7FipAg98BN4LZrL+8sGYMy2k8EAFzSB3F0tU5fi0f+R0F7CtKhK4nKCC5Hg70odN7HePobDw9dfR6hExLcSpUJBlUmpU0Lw1DL3MLjEEcfgzOYHmmrBv9rI4KU=,iv:2bIH2i874H1vg+nBJhsxohSYsjpFTb1toRw8mK5UN40=,tag:V2uijc0BymsLg3vDsHob9w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1