mercury: join the tailnet

mercury was the only host with no tailscale at all -- no module import,
no secret, no key in its sops file. It had been enrolled before the NixOS
migration and silently dropped off the tailnet when it was reflashed with
a config that omitted it.

--accept-dns=false, as on neptun and for a sharper reason: headscale
pushes override_local_dns, so accepting MagicDNS would repoint the LAN's
own DNS server at 100.100.100.100 and make house-wide name resolution
depend on tailscaled being up. This host has already deadlocked once on
boot-time DNS (see CLAUDE.md).

darman_password is also rotated: the account had "!" in /etc/shadow,
because on mercury's first boot the secret wasn't readable yet and
update-users-groups.pl falls back to a locked account. mutableUsers is
true, so no later rebuild ever revisited it and the lock was permanent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

secrets/mercury.yaml

@@ -1,5 +1,6 @@
-darman_password: ENC[AES256_GCM,data:Wc7y/5QPUxD4mxDGBp9V2k6YNrbmehbpcltInIBSGk70cdqxSUOjHZIL0hzPS4ijrXPnR9gwSZbc7EmgbLZ2K96SJtz9+upDAQVVUFfNx0o+SfGEu3ai3Qi7tKa+1N9wZQW/+6gQOAMAGQ==,iv:K/GrcQFtYWgQAtDlNVaYS5jUADYfX6rMSIUM9niRcWQ=,tag:9dbiRlIzAkm382Bkc6LfJA==,type:str]
+darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str]
 pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:CZe1wkh2DNF2g4wy30Wph0c4/3f1M2K9Up+3oAcLEVdZjJzLRJotAU/0Nw2PSGoDZTtqOSfDaEXsaa45DBIJj2EUvWKSYrkV4XkLCio6ZWoGhmxH9PYfkw==,iv:UqNZz7grRPT/d1a2Tv1PW4H2k5FeZCuDy/fK+jVou9E=,tag:cYbLk+7JqU/1by8j2ri0Xg==,type:str]
 sops:
     age:
         - enc: |
@@ -20,7 +21,7 @@ sops:
             x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
-    lastmodified: "2026-07-13T20:42:08Z"
-    mac: ENC[AES256_GCM,data:TWismb9lTPOp9RC0u7zlQPoJtql5G0obxFIcI2D4R43VCRKux6LPzZvVEwLe7KjkLC9c6p+ti1dy4lIL9lo57BJfyh1HV+u+RvVCTbVw0Cd8EoGCC3NWJ+jFJi6jWAwOdJ2SOgOavpxBaFObYpEGkJ4XZqJX7XCY/k4YuuFT/yo=,iv:XtHOSE2ZH3j3blSWkXUqxWmZOO1tVEKoWgHB7rt81qA=,tag:7JBmUyHgqSbrmNqPXfXMTQ==,type:str]
+    lastmodified: "2026-07-20T08:31:19Z"
+    mac: ENC[AES256_GCM,data:kdWGhCOENvnUAnwbLW58JH8Ur+g+f4Z1pr3seZGGOFa04xeXb5HOzegpIH+x7OT5OvsKZsMKWf7sBGgB/nx+m2ZKy4NLC39dLbV8V5hs18NhRKl5vKZBZHE1D2xAK4+REwRYT6LiXArQssPv9e2q5fcW6q3rtnlHMF0tUsWip9o=,iv:BkKv2ZBxZMX4agHTzF2Mcmasxpp+hqkiu9mH0mUeLS4=,tag:t0MeKRPikYR5MAmU8r77sg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1