feat: log in and sudo over SSH with a CanoKey touch

The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo.

Risks to weigh:

- Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first.
- Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch.

### Verification

- `just test` exits 0; CI passed on the first commit.
- Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`.
- Not yet verified on a running host.

### Manual step after merge

Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH.

AI assistance: DeepSeek Harness (claude-opus-5-5).

Assisted-by: DeepSeek Harness (claude-opus-5-5)

home/base/tui/ssh.nix

@@ -65,7 +65,15 @@ in
       }
       // lanHost;
     }
-    // lib.genAttrs (builtins.attrNames myvars.networking.hostsAddr) (_: lanHost);
+    # Aliases forward the agent like their addresses do; servers ask it for sudo
+    # (modules/nixos/server/ssh-agent-sudo.nix).
+    // lib.genAttrs (builtins.attrNames myvars.networking.hostsAddr) (
+      _:
+      {
+        ForwardAgent = true;
+      }
+      // lanHost
+    );
   };
 
   # Keep ~/.ssh/config a real, user-owned file rather than a /nix/store symlink.