feat: sops decrypts via pre-generated SSH host key (works on boot #1)

- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/secrets.nix

@@ -2,14 +2,16 @@
 
 # sops-nix secret wiring (real host only; not imported by vm.nix).
 # Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
-# /run/secrets/<name>. The host needs the age PRIVATE key at the keyFile path.
+# /run/secrets/<name>.
 #
-# Deploy the private key with the install, e.g. nixos-anywhere:
-#   --extra-files, placing your key at /var/lib/sops-nix/key.txt
-# or later derive a host age key from its ssh host key and add it to .sops.yaml.
+# The host decrypts with its OWN SSH host key (age identity derived via
+# ssh-to-age, recipient listed in ../.sops.yaml). The key is pre-generated on
+# the laptop and shipped once at install as /etc/ssh/ssh_host_ed25519_key
+# (nixos-anywhere --extra-files) — so decryption works on boot #1 and there is
+# no separate sops-only key to manage.
 {
   sops.defaultSopsFile = ../secrets/jupiter.yaml;
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   # Decrypts to /run/secrets/samba_password (root-only by default).
   sops.secrets.samba_password = { };