refactor: rename vps host -> neptun (solar-system theme)

git-mv hosts/vps->neptun, secrets/vps.yaml->neptun.yaml; update flake, .sops.yaml
rules, hostName, sops paths, README/CLAUDE. Off-repo host key dir renamed too.

README.md

@@ -5,7 +5,7 @@ Flake-based NixOS config. Host: `jupiter` (ZimaBlade, NAS + services).
 ## Structure
 
 ```
-flake.nix                  # inputs + nixosConfigurations (jupiter, vps, kexec, ...)
+flake.nix                  # inputs + nixosConfigurations (jupiter, neptun, kexec, ...)
 common.nix                 # shared base: user, ssh, nix, firewall, timezone
 services/                  # one reusable module per service
   samba.nix  avahi.nix  audiobookshelf.nix  containers.nix  caddy.nix  tailscale.nix
@@ -16,9 +16,9 @@ hosts/
     hardware-configuration.nix
     secrets.nix            #   sops-nix wiring
     vm.nix                 #   VirtualBox test image (jupiter-vbox)
-  vps/                     # netcup public reverse proxy + tailnet node
+  neptun/                     # netcup public reverse proxy + tailnet node
     configuration.nix  disk-config.nix  hardware-configuration.nix  secrets.nix
-secrets/                   # age-encrypted sops files (jupiter.yaml, vps.yaml)
+secrets/                   # age-encrypted sops files (jupiter.yaml, neptun.yaml)
 scripts/                   # deploy, edit_secrets
 ```
 
@@ -86,13 +86,13 @@ All arguments mandatory — no default host, no default config.
 ./deploy switch  <config> <host>   # rebuild + activate on a running host
 ./deploy boot|test <config> <host> # stage for next boot / activate without boot entry
 ```
-`<config>` is a `nixosConfigurations` name (`jupiter`, `vps`). Its pre-generated
+`<config>` is a `nixosConfigurations` name (`jupiter`, `neptun`). Its pre-generated
 SSH host key lives at `~/.config/homelab/<config>/ssh_host_ed25519_key`.
 
 Examples:
 ```
 ./deploy switch jupiter jupiter.sol
-./deploy install vps 159.195.64.117
+./deploy install neptun 159.195.64.117
 ```
 Rollback: `nixos-rebuild switch --rollback` on the host, or pick a prior
 generation at boot.