mercury: join the tailnet

mercury was the only host with no tailscale at all -- no module import,
no secret, no key in its sops file. It had been enrolled before the NixOS
migration and silently dropped off the tailnet when it was reflashed with
a config that omitted it.

--accept-dns=false, as on neptun and for a sharper reason: headscale
pushes override_local_dns, so accepting MagicDNS would repoint the LAN's
own DNS server at 100.100.100.100 and make house-wide name resolution
depend on tailscaled being up. This host has already deadlocked once on
boot-time DNS (see CLAUDE.md).

darman_password is also rotated: the account had "!" in /etc/shadow,
because on mercury's first boot the secret wasn't readable yet and
update-users-groups.pl falls back to a locked account. mutableUsers is
true, so no later rebuild ever revisited it and the lock was permanent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/mercury/secrets.nix

@@ -15,4 +15,8 @@
   # host = different password per host.
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
+
+  # Pre-auth key for services/vpn/tailscale.nix. Root-owned 0400 is right:
+  # tailscaled runs as root and reads authKeyFile itself.
+  sops.secrets.tailscale_authkey = { };
 }