add mars host, move Hermes Agent there from jupiter

New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.

hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ

hosts/mars/configuration.nix

@@ -0,0 +1,49 @@
+{ config, pkgs, ... }:
+
+# mars — on-site x86_64 box, single-purpose: runs Hermes Agent only.
+# See hermes-agent.nix for what that is and why it moved here from jupiter.
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disk-config.nix          # disko: OS-disk partitions + filesystems
+    ./secrets.nix              # sops-nix: samba/tailscale/hermes secrets
+    ./hermes-agent.nix
+    ../../common.nix              # shared base: user / ssh / nix / firewall
+    ../../services/containers.nix
+    ../../services/vpn/tailscale.nix
+  ];
+
+  networking.hostName = "mars";
+  networking.networkmanager.enable = true;   # DHCP on-site, same as jupiter
+  users.users.darman.extraGroups = [ "docker" ];   # merges with common.nix; podman debug access
+
+  # ---- Boot (UEFI, confirmed) ----
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # jupiter's samba share (services/network/samba.nix) — mounted on demand so
+  # mars doesn't stall boot/login when jupiter is off or unreachable. This is
+  # also where Hermes's shared dropbox lives now (hermes-agent.nix). Modes are
+  # tighter than terra's equivalent mount (0770 not 0755, gid=hermes not
+  # gid=users) since the hermes-agent container (uid 986, gid 983 — no podman
+  # userns remapping, see services/network/pihole.nix) needs group write into
+  # it, not just darman.
+  fileSystems."/mnt/jupiter" = {
+    device = "//jupiter/data";
+    fsType = "cifs";
+    options = [
+      "credentials=${config.sops.templates."jupiter-smb.credentials".path}"
+      "uid=1000"
+      "gid=983"
+      "file_mode=0770"
+      "dir_mode=0770"
+      "nofail"
+      "x-systemd.automount"
+      "x-systemd.idle-timeout=60"
+      "x-systemd.mount-timeout=10s"
+      "_netdev"
+    ];
+  };
+
+  system.stateVersion = "26.05";   # set at install time; do NOT bump on upgrades
+}