feat: scaffold netcup vps host (disko/vda, static net, tailscale, caddy)

- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda
- static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS
- tailscale via headscale + sops authkey (secrets/vps.yaml, own host key)
- caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000
- shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules

.sops.yaml

@@ -8,12 +8,16 @@
 keys:
   # admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
   - &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
-  # jupiter host key — derived from its pre-generated SSH host key with
-  # ssh-to-age. The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
+  # per-host keys — derived from each box's pre-generated SSH host key
+  # (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
   - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
+  - &vps age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
+# Each host's secrets go to admin (edit) + that host only. Order matters:
+# the first matching rule wins, so keep these specific paths.
 creation_rules:
-  - path_regex: secrets/.*\.yaml$
+  - path_regex: secrets/jupiter\.yaml$
     key_groups:
-      - age:
-          - *admin
-          - *jupiter
+      - age: [ *admin, *jupiter ]
+  - path_regex: secrets/vps\.yaml$
+    key_groups:
+      - age: [ *admin, *vps ]