feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
  -> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
  admin password set via web setup on first boot (never in repo/store)

services/adguardhome.nix

@@ -2,24 +2,23 @@
 
 # AdGuard Home — network DNS (adblock) + DHCP.
 # Forwards to the local unbound recursive resolver (services/unbound.nix).
-# Config is nix-owned (mutableSettings = false): the web UI can view but not
-# persist changes — edit here and redeploy. EXCEPTION: DHCP static leases live
-# in AdGuard's separate leases.json, so add those in the UI (they persist).
+#
+# Password note: the AdGuard NixOS module has NO secret/passwordFile hook, and
+# its config must be writable at runtime — so a sops secret can't be injected
+# cleanly. Instead `mutableSettings = true`: the `settings` below are merged
+# into AdGuard's state on start, and the ADMIN PASSWORD is set once via the web
+# setup wizard on first boot (stored only in the Pi's runtime state — never in
+# the repo or nix store). Trade-off: UI edits to other fields also persist.
+# DHCP static leases likewise live in AdGuard's leases.json (add via UI).
 {
   services.adguardhome = {
     enable = true;
     openFirewall = true;          # opens the web + DNS ports
-    mutableSettings = false;      # AdGuardHome.yaml is authoritative from nix
+    mutableSettings = true;       # merge settings; keep UI-set password + leases
     # allowDHCP is implied by settings.dhcp.enabled (grants NET_RAW/NET_BIND).
 
     settings = {
-      # Web UI on :3000. Admin login — replace with YOUR bcrypt hash:
-      #   nix run nixpkgs#apacheHttpd -- htpasswd -B -n -b admin 'yourpassword'
-      # (take the part after "admin:"). For repo hygiene, move this to sops later.
-      http.address = "0.0.0.0:3000";
-      users = [
-        { name = "admin"; password = "$2y$10$REPLACE-WITH-BCRYPT-HASH"; }
-      ];
+      http.address = "0.0.0.0:3000";   # web UI; set the admin password here on first boot
 
       dns = {
         bind_hosts = [ "0.0.0.0" ];