feat: sops decrypts via pre-generated SSH host key (works on boot #1)

- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -4,3 +4,10 @@ result-*
 
 # built artifacts
 *.ova
+
+# private keys — must never be committed (they live off-repo in ~/.config)
+*_ed25519_key
+*.pem
+id_*
+age-keys.txt
+keys.txt