feat(canokey): enroll new CanoKeys and retire per-host SSH keys (#524)

Hosts now accept only the two CanoKeys' resident SSH keys for ryan, plus the romantic recovery key for root; per-host user keys stop working. Darwin builds work again: the shared base no longer sets nixpkgs.config next to nix-darwin's nixpkgs.pkgs.

Assisted-by: DeepSeek Harness (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)

vars/default.nix

@@ -1,11 +1,13 @@
 { lib }:
 let
-  # CanoKey resident SSH keys: they log in like the main keys, and they are the
-  # only keys pam_rssh accepts for sudo on servers through the forwarded agent
+  # CanoKey resident SSH keys: the only user keys, and the only keys pam_rssh
+  # accepts for sudo on servers through the forwarded agent
   # (modules/nixos/server/ssh-agent-sudo.nix).
   canokeySshKeys = [
-    # CanoKey Canary (backup)
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKgfNy/wJgTw6auO4RmRHR9kh1Mt5TYNkomMDFLJ4Kw6AAAADHNzaDpyeWFuNHlpbg== ryan@canokey-moe"
+    # canokey-tea (main)
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINuvSs4skjxNCTvN5k8rihUXOCst/XChw37aDeOmz+vvAAAAEHNzaDpyeWFuNHlpbi10ZWE= ryan@canokey-tea"
+    # canokey-moe (backup)
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEZKUA4pNWvXKCpPQZHgctlR6O/71QirBQNt2RC5QsdfAAAAEHNzaDpyeWFuNHlpbi1tb2U= ryan@canokey-moe"
   ];
 in
 {
@@ -21,30 +23,15 @@ in
   # Purpose: system login password only
   # https://man.archlinux.org/man/crypt.5.en
   initialHashedPassword = "$y$jFT$RBapCH3F6bc0uSF.FaUGB.$rvhiVvcCKxkkumDFLONV5zFP1lsv1VyZ1ErH.r2rNk3";
-  # Public Keys that can be used to login to all my PCs, Macbooks, and servers.
-  #
-  # Since its authority is so large, we must strengthen its security:
-  # 1. The corresponding private key must be:
-  #    1. Generated locally on every trusted client via:
-  #      ```bash
-  #      # KDF: bcrypt with 256 rounds, takes 2s on Apple M2):
-  #      # Passphrase: digits + letters + symbols, 12+ chars
-  #      ssh-keygen -t ed25519 -a 256 -C "ryan@xxx" -f ~/.ssh/xxx
-  #      ```
-  #    2. Never leave the device and never sent over the network.
-  # 2. Or just use hardware security keys like Yubikey/CanoKey.
-  mainSshAuthorizedKeys = [
-    # The main ssh keys for daily usage
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKlN+Q/GxvwxDX/OAjJHaNFEznEN4Tw4E4TwqQu/eD6 ryan@idols-ai"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwoI5MAogEa726jwwHL5EgM1X/i2A5d2pgV7i7t8fzB ryan@shoukei"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDc1PNTXzzvd93E+e9LXvnEzqgUI5gMTEF/IitvzgmL+ ryan@frieren"
-  ]
-  ++ canokeySshKeys;
+  # Public keys that log in to all my PCs, Macbooks, and servers.
+  mainSshAuthorizedKeys = canokeySshKeys;
   # CanoKey U2F registrations for sudo (modules/nixos/desktop/canokey.nix).
   # Key handles and public keys only, so they are safe to commit.
   canokeyU2fKeys = [
-    # CanoKey Canary (backup)
-    "DwXDxVU+NDTUZs/d2EjpsPAh4mrg7dqdg/mAozkw/mUAAdEYDZIbm8kTBUGA49wXW0ZvSpF9VNYh2w84Xz9nAIAW////+Q==,6hqEjWBJ+ueBKBJaNijNkUsmlgEHMgv0KdpprqdJjHKoU/FKpeqo12SWlvdgiIVWvqTaGfe4fNu/ckcGY5mlsA==,es256,+presence"
+    # canokey-tea (main)
+    "1pS52FIPHfevn97Hiz5+OOFe0OaPBPqIrsD0r/mC/YIAAdEYDZIbm8kTBUGA49wXW0ZvSpF9VNYh2w84Xz9nAIAW////+Q==,LkVavaZRhu8nHhIj1r2N78BwOlU32Y/AAGkekzn5DLQCztnMs4uslIAvzzaNNCpaDu49xwZm4TqPBDKg0IuIlA==,es256,+presence"
+    # canokey-moe (backup)
+    "dxdeYeJTx40VhgPll05COx1Vn3WRKuXNgtHCTpTSyq0AAdEYDZIbm8kTBUGA49wXW0ZvSpF9VNYh2w84Xz9nAIAW////+Q==,cpBHKCdambMTGau3+eXVyv4JWQK7ZQ+8AbRt0EevCL0DeftDdXX6aatHSpbiXAhjip3R8pfeXi6GTW67YpdCPw==,es256,+presence"
   ];
   secondaryAuthorizedKeys = [
     # the backup ssh keys for disaster recovery