refactor: rename vps host -> neptun (solar-system theme)

git-mv hosts/vps->neptun, secrets/vps.yaml->neptun.yaml; update flake, .sops.yaml
rules, hostName, sops paths, README/CLAUDE. Off-repo host key dir renamed too.

CLAUDE.md

@@ -3,7 +3,7 @@
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
 Flake-based NixOS config for a homelab. Hosts: **jupiter** (ZimaBlade NAS, x86_64),
-**vps** (netcup public reverse proxy + tailnet node, x86_64), **mercury** (Raspberry
+**neptun** (netcup public reverse proxy + tailnet node, x86_64), **mercury** (Raspberry
 Pi 3B+ DNS/DHCP, aarch64). See `README.md` for the full install/deploy walkthrough.
 
 ## Layout
@@ -21,7 +21,7 @@ scripts/edit_secrets
 
 A host = `common.nix` + the `services/*` modules it imports + its `hosts/<h>/configuration.nix`.
 `services/` modules are engine-agnostic and shared across hosts (e.g. `tailscale.nix`,
-`caddy.nix` used by jupiter and vps).
+`caddy.nix` used by jupiter and neptun).
 
 ## Commands
 
@@ -59,7 +59,7 @@ nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
 - Each `secrets/<host>.yaml` is encrypted to the **admin** key (edit) + that **host's**
   key (runtime decrypt); rules in `.sops.yaml`. Private keys live OFF-repo:
   `~/.config/sops/age/keys.txt` (admin), `~/.config/homelab/<host>/` (host keys).
-- jupiter/vps decrypt with their **ssh host key** (`ssh-to-age` recipient), shipped at
+- jupiter/neptun decrypt with their **ssh host key** (`ssh-to-age` recipient), shipped at
   install via `nixos-anywhere --extra-files`.
 - mercury (SD image, no `--extra-files`) uses a **dedicated age key** at
   `/var/lib/sops-nix/age.txt` — `./scripts/deploy flash` writes it to the ext4 root partition.