add mars host, move Hermes Agent there from jupiter

New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.

hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ

hosts/jupiter/secrets.nix

@@ -64,21 +64,4 @@
   sops.secrets.sabnzbd_eweka_username.owner = "sabnzbd";
   sops.secrets.sabnzbd_eweka_password.owner = "sabnzbd";
 
-  # Hermes Agent (hosts/jupiter/hermes-agent.nix) — a separate, isolated
-  # instance from terra's, with its OWN Telegram bot token (sharing terra's
-  # would 409-conflict two long-pollers on one token). opencode_go_api_key
-  # is the same provider account as terra (hosts/terra/secrets.nix) — a
-  # stateless API key, fine to duplicate across hosts. No owner override:
-  # sops.templates renders via a root-run activation script, which the
-  # hermes module's own activation script (also root) then reads — unlike
-  # sabnzbd's preStart, this doesn't run as the service's own user.
-  sops.secrets.opencode_go_api_key = { };
-  sops.secrets.telegram_bot_token = { };
-  sops.templates."hermes-agent.env".content = ''
-    OPENCODE_GO_API_KEY=${config.sops.placeholder.opencode_go_api_key}
-    TELEGRAM_BOT_TOKEN=${config.sops.placeholder.telegram_bot_token}
-    TELEGRAM_HOME_CHANNEL=15151223
-    TELEGRAM_ALLOWED_USERS=15151223
-  '';
-
 }