add mars host, move Hermes Agent there from jupiter

New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.

hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ

flake.nix

@@ -33,11 +33,6 @@
     };
     authentik-nix.url = "github:nix-community/authentik-nix";
     nix-flatpak.url = "github:gmodena/nix-flatpak";
-    # Hermes Agent (see hosts/jupiter/hermes-agent.nix) — Tier 2 platform
-    # per its own docs (best-effort Nix support, can break on any upstream
-    # commit), so pinned like everything else via flake.lock rather than
-    # followed loosely.
-    hermes-agent.url = "github:NousResearch/hermes-agent";
     # Own Hyprland plugin (border + title bar), public repo, fetched over
     # https (no credentials needed, unlike tome below). `nixpkgs.follows` is
     # what makes its packaged build ABI-correct — Hyprland plugins are
@@ -85,7 +80,6 @@
           modules = [
             disko.nixosModules.disko
             sops-nix.nixosModules.sops
-            inputs.hermes-agent.nixosModules.default
             ./hosts/jupiter/configuration.nix
           ];
         };
@@ -115,6 +109,18 @@
           ];
         };
 
+        # mars — on-site x86_64 box, single-purpose: Hermes Agent only.
+        # See hosts/mars/*.
+        mars = nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit inputs; };
+          modules = [
+            disko.nixosModules.disko
+            sops-nix.nixosModules.sops
+            ./hosts/mars/configuration.nix
+          ];
+        };
+
         # mercury — Raspberry Pi 3B+ (aarch64), DNS/DHCP. Boots from an SD image:
         #   nix build .#nixosConfigurations.mercury.config.system.build.sdImage
         # (aarch64 build — needs binfmt/qemu on this x86 host, or a remote/aarch64
@@ -177,7 +183,7 @@
             nixos-images.nixosModules.kexec-installer
             ({ ... }: {
               users.users.root.openssh.authorizedKeys.keys = [
-                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD5K6AQ0wYYHbNGzC4PyunUQsXbaD0iu1eaadLtv+Xp darman@terra"
               ];
             })
           ];
@@ -201,9 +207,10 @@
               services.openssh.enable = true;
               services.openssh.settings.PermitRootLogin = "prohibit-password";
               users.users.root.openssh.authorizedKeys.keys = [
-                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD5K6AQ0wYYHbNGzC4PyunUQsXbaD0iu1eaadLtv+Xp darman@terra"
               ];
               networking.hostName = "homelab-installer";
+              console.keyMap = "de";   # matches common.nix's real hosts
               environment.systemPackages = [ pkgs.git ];
 
               # findiso= is a SCRIPT-stage-1 feature (stage-1-init.sh) only. The