headplane: point OIDC at the real Authentik app; rotate tailnet keys

The Authentik provider and application now exist (slug "headplane", which
is what makes the issuer .../application/o/headplane/), so the client ID
is a real value rather than a placeholder, and the client secret and
headscale API key are in sops.

The tailscale pre-auth keys for neptun and jupiter are rotated because
the tailnet was recreated from scratch: the old headscale database went
with the VPS's OS disk, so every key issued against it is meaningless to
the new control server.

Note the headscale API key defaults to a 90d expiry. When it lapses
headplane stops listing nodes with no obvious cause -- `headscale apikeys
list` shows the date.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/vpn/headplane.nix

@@ -53,7 +53,9 @@
 
     settings.oidc = {
       issuer = "https://auth.mgaction.town/application/o/headplane/";
-      client_id = "REPLACE_ME_authentik_client_id"; # not secret, but not known until the app exists in Authentik
+      # Not a secret — Authentik hands the client ID out at the authorize
+      # endpoint. Regenerating the provider in Authentik changes it.
+      client_id = "NNzYUrSBlCqxyCTfxlEJRpT5v5EQWHLpfOsXBine";
       client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path;
       headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path;
     };