feat(canokey): enroll new CanoKeys and retire per-host SSH keys (#524)

Hosts now accept only the two CanoKeys' resident SSH keys for ryan, plus the romantic recovery key for root; per-host user keys stop working. Darwin builds work again: the shared base no longer sets nixpkgs.config next to nix-darwin's nixpkgs.pkgs.

Assisted-by: DeepSeek Harness (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)

modules/base/nix.nix

@@ -1,12 +1,9 @@
 {
   pkgs,
   config,
-  nixpkgsConfig,
   ...
 }:
 {
-  nixpkgs.config = nixpkgsConfig;
-
   nix.settings = {
     # enable flakes globally
     experimental-features = [

modules/nixos/base/nix.nix

@@ -1,4 +1,9 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  nixpkgsConfig,
+  ...
+}:
 {
   # Nix 2.35 is newer than nixpkgs' nixVersions.stable (still 2.34), so opt into
   # the latest released version until stable catches up.
@@ -9,8 +14,9 @@
   # https://lix.systems/add-to-config/
   # nix.package = pkgs.lix;
 
-  # to install chrome, you need to enable unfree packages
-  nixpkgs.config.allowUnfree = lib.mkDefault true;
+  # NixOS only: darwin's nixpkgs.pkgs instance already carries it (lib/macosSystem.nix),
+  # and nixpkgs rejects nixpkgs.config next to nixpkgs.pkgs.
+  nixpkgs.config = nixpkgsConfig;
 
   # do garbage collection weekly to keep disk usage low
   nix.gc = {