feat: sops decrypts via pre-generated SSH host key (works on boot #1)

- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.sops.yaml

@@ -6,9 +6,14 @@
 # Add the host's own age key here later (derived from its ssh host key) so the
 # machine can decrypt without shipping a separate key.
 keys:
+  # admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
   - &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
+  # jupiter host key — derived from its pre-generated SSH host key with
+  # ssh-to-age. The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
+  - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
 creation_rules:
   - path_regex: secrets/.*\.yaml$
     key_groups:
       - age:
           - *admin
+          - *jupiter