add mars host, move Hermes Agent there from jupiter

New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.

hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ

secrets/mercury.yaml

@@ -1,6 +1,6 @@
 darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str]
 pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:t/GuqomGLOXnGOOw2fNdbzfBMloz3WoJV+WBEvnFmxYpIBLdJwas4aJD6Jpc+SW+gsb1njb4JPxl11UMxuzBbno8DCIZv21DOc1vVbl4VcDI7kvrw3EkEg==,iv:0I/0sR/Uvbhcq2eqGPQEs1jCFhTkJrtQ/Op2Uvj2LPk=,tag:mrWn/yvy8GhvuqrScR7vrQ==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:swWBS6icqidKMBC6Fo8IyOWIswWzGpRJGhFfA1JPlZsvqEo46J/kLjC6wfU4eOhSBsWTYiiqtHDaX05SKr8gwSxA/ERwj/Swf8bNHST4rbKrI4Cq5QDfzA==,iv:UUdVgkFATla6pmErn2oT06PuQ/kv9L8g0nX2CCPaJhI=,tag:97gAUSfxHzemVljl8FTULw==,type:str]
 sops:
     age:
         - enc: |
@@ -21,7 +21,7 @@ sops:
             x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
-    lastmodified: "2026-07-24T23:31:02Z"
-    mac: ENC[AES256_GCM,data:I3RHwPnGHFXAeRJ4ic2plfhHMz91488KvzN6V15evutEN++affTqJIvI/Hh5Q5LAn8Q8hNkCS9l5Jl/snz+qtlwsSscckcs7jpWSI9cgSYjgEX6DjKpS+95qJo+SabzLdkiY3BlTjzcFZg7CG/lB5MunWgENY/Ad4GGlmUFnMeo=,iv:bWRltxSAd+fiIfQIp+ieqmpob6Fzbrmk1wRJDz3CjSI=,tag:r6BViobJD3MsvLw7Yyj4Rg==,type:str]
+    lastmodified: "2026-08-21T23:14:15Z"
+    mac: ENC[AES256_GCM,data:zxV+szKjxb+7EV/hSyFeHUs/V2wZgIz8NO78/RDZeGoGtCjwDGiSIFsO1VQI5LZPW+O+pTnT2s4W5P0QuEjYrkPU5LRunW+Tv87XrDBqoR62vPvhRmt0wZXOQZu4oAn7LGpn24xo5QYKc2JowJWIVlyQs03UL3jQtgwfkG9u8k4=,iv:IZpZlUVqaKjO0aokwtF2hFAqC2D9H5bVMO6HezmYQ+Y=,tag:ij6pu3b6CQzctrJ87ifp5Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2