feat(deploy flash): auto-install sops age key onto the SD boot partition

- after dd, if ~/.config/homelab/<config>/age.txt exists, mount the FAT boot
  partition and drop it as sops-age.txt (mercury). Key stays off-repo + out of
  the store + out of the image; no manual mount step.

scripts/deploy

@@ -11,7 +11,9 @@
 #   ./deploy boot    <config> <host>  stage for next boot, don't activate now.
 #   ./deploy test    <config> <host>  activate without adding a boot entry.
 #   ./deploy image   <config>         build an SD-card image (e.g. rpi mercury).
-#   ./deploy flash   <config> <dev>   build the SD image + write it to <dev>.
+#   ./deploy flash   <config> <dev>   build SD image, write to <dev>, and (if
+#                                     ~/.config/homelab/<config>/age.txt exists)
+#                                     drop the sops key on its boot partition.
 #
 # <config> = a nixosConfigurations name (e.g. jupiter, vps). Its pre-generated
 # SSH host key must be at ~/.config/homelab/<config>/ssh_host_ed25519_key.
@@ -115,6 +117,24 @@ case "$cmd" in
     [ "$ok" = yes ] || die "aborted"
     zstdcat "$img" | sudo dd of="$dev" bs=4M status=progress oflag=sync
     sync
+
+    # If this config has a dedicated sops age key, drop it on the FAT boot
+    # partition (mounts at /boot/firmware) so sops decrypts on first boot.
+    # Key stays off-repo and out of the nix store; the image itself has no key.
+    keyfile="$HOME/.config/homelab/$config/age.txt"
+    if [ -f "$keyfile" ]; then
+      echo ">> installing sops age key onto the boot partition"
+      sudo partprobe "$dev" 2>/dev/null || sudo blockdev --rereadpt "$dev" 2>/dev/null || true
+      sudo udevadm settle 2>/dev/null || true
+      fatpart="$(lsblk -lno PATH,FSTYPE "$dev" | awk '$2=="vfat"{print $1; exit}')"
+      [ -n "$fatpart" ] || die "no FAT boot partition found on $dev — copy $keyfile to it manually as sops-age.txt"
+      mnt="$(mktemp -d)"
+      sudo mount "$fatpart" "$mnt"
+      sudo cp "$keyfile" "$mnt/sops-age.txt"
+      sudo sync
+      sudo umount "$mnt"; rmdir "$mnt"
+      echo ">> age key installed (sops-age.txt)"
+    fi
     echo ">> done — insert the card into the Pi and boot."
     ;;