add mars host, move Hermes Agent there from jupiter

New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.

hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ

secrets/neptun.yaml

@@ -2,7 +2,7 @@ darman_password: ENC[AES256_GCM,data:7G2Hgh13TxI6ugw2ebp9UtLTQ7HRC/hrCga0FmZo8h8
 authentik_secret_key: ENC[AES256_GCM,data:qLrAWBywlMqT6D3FYDqE9I/5Ep+zDVu9ns9TA4UVOBSQ1uFGEj01TU9norqPf12pi9/Qs32mVzm5BqDG259DxdGT9DZVQc03QVwiIQYtmWo=,iv:OVCIxIP1Xv+nHmYsrxaPgYWQiwzVPUe8pnbyMBVAuoI=,tag:+ywkwPqkY1Dkx1R5cUJ7PA==,type:str]
 authentik_bootstrap_email: ENC[AES256_GCM,data:OmqpKAiiFyS/rytnHYRZ,iv:VXiPV5VfduC/IW+E3gDlNAeE+hr+IZ9W7Ty6Npuu59Y=,tag:rjvTHnBxN/pMvpQC5W9S6Q==,type:str]
 authentik_bootstrap_password: ENC[AES256_GCM,data:QPCY0ni3jBQY5HyK+vRlyT4YTEo=,iv:41u1Jf+WYksPUY4pvKdHQA1RHW21GAfdVDRuQ7XtdYc=,tag:SYmzv26GbE1kwleXyKLG4Q==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:1uxBqERZ7U+Fr5vBaGGKajN5KsRzRpdxGBULQ6b5hSgpt2MIC3/Th4zHGNdOl5xYmH2STYv8IOOQrb5p8Xr/55laWQbOLPlfIpCNUbiVWk7uEX9+ctTSiw==,iv:Lm8vx3Oku+isW2WqSNGrkf8aqGoAwVsJQwqH3jOv06Y=,tag:opZeSMyf3bdrLnPM+yES5g==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:mKOC26CLzqsUrgr9C9AqTA+7KFPlFq4wIh81dZ8lapcY5b1RMp9XTaac5e1YXnFQtC+g8ROo3UR5NiUXepQvnaV2YQ0YwsUcrFN33UcqHgwy87YMrfKaoQ==,iv:xp/ljoD6gqVrZ0gzeYbF9wUOtsDgUIMKd/O1nH3NZpg=,tag:pb0QIiRoHEwfm3rCxO/urA==,type:str]
 headplane_cookie_secret: ENC[AES256_GCM,data:oXYRG4z16u6HS7zXoWrV2q/HL2o24n4UwVXnQvqBmbY=,iv:itAiy/w6ue4VzqO5xYnvSYN3uCLLmu52dvAAxZ2pCGc=,tag:MEFP171GpSQpAqUFsWY+VA==,type:str]
 headplane_oidc_client_secret: ENC[AES256_GCM,data:RiEESz1WHYH/smlJKmKFpPoF5HRYp8gHJoKqc49xRRuU9WnQCnmETie/68u37sSVniQmQZSOmXxdmvuuJgP5LMcPdkrQmQE+QX80RQhtTVvg2AhqRaK4V+qfQleD/aJjoIHojeM3UBUi4kYOhDJF0FFTP+qR4oitH6W8/2jxRsc=,iv:hXquOglPhRv+QTVRw5fkY7BWuwLtJxK5tNERGBOOmt8=,tag:2KczveRWoq7iTOdwjO+AUw==,type:str]
 headplane_headscale_api_key: ENC[AES256_GCM,data:KcwcprV100wfAkn+YM4+1oTfXkmyeAMAbXNpQKf2iIq0VxwqVep+fORrKmHiwDViciDoyxdMiT4scGlmd4vQRsWEHdDpkuH7MRHYu0hQepE3rSSQAMbK,iv:NEhmi2hiOE+uSIRZ4uXOK1UGpN+FQx/NpooWzTgwik8=,tag:KcPsD4gp51ERaFwgfA0BrQ==,type:str]
@@ -28,7 +28,7 @@ sops:
             Wptkf76aP9UpjhgNkxzedRebQPB7ti+UiVqCvLVimtuHcsm/NJPcRg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
-    lastmodified: "2026-07-24T23:31:37Z"
-    mac: ENC[AES256_GCM,data:eYiDMFoicUBJbkJ0d5QCwq+YxaslrQDrSCUufzvZ9PkJJ7wWLgq/9ZwMYZfuTR0iWAQCHyhwOEStuLSUT1p51uLS2cSOQtWZfkBOEdUq9HPzzlOMFxyEh052Dw0fkBNswB9oYBdqOfMX8X4z320JlQNUaR/UQ977dkaLaDCMDt8=,iv:kW2D47/VaOPpbITaGnIwpX3Xrv/4JuDfL7QpQFT3OE8=,tag:v6eUKtQ1lfzDmdxQpMWwrw==,type:str]
+    lastmodified: "2026-08-21T23:14:15Z"
+    mac: ENC[AES256_GCM,data:O1wp0QLbfi7hn7+IoKkk+xqGYLX95y9KgVCsjyDjsv6eqiP+RPz5PmEqXapt926HREEPi4vcDW2FbaBMTqtsojbhWMTG0lYmV6zSQ4aDueL9/GmDqdOJDtQdbXhJH9gpAVhwGQzNoRDQ/5wjknDI8GSBVO077aSaaiGbreuuzBQ=,iv:yecrpLaDNFqt7XxHv/KDTXgjOs+5fk/6UXCSxPMuoJ0=,tag:m7co54lvtnZIYqSMX2c3kQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2