feat(canokey): enroll new CanoKeys and retire per-host SSH keys (#524)

Hosts now accept only the two CanoKeys' resident SSH keys for ryan, plus the romantic recovery key for root; per-host user keys stop working. Darwin builds work again: the shared base no longer sets nixpkgs.config next to nix-darwin's nixpkgs.pkgs.

Assisted-by: DeepSeek Harness (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)

outputs/aarch64-darwin/tests/nixpkgs-config/expected.nix

@@ -0,0 +1,11 @@
+{
+  lib,
+  outputs,
+}:
+let
+  hostsNames = builtins.attrNames outputs.darwinConfigurations;
+  # nix-darwin passes an external instance through `nixpkgs.pkgs`, and nixpkgs
+  # asserts that `nixpkgs.config` stays empty in that case.
+  expected = lib.genAttrs hostsNames (_: true);
+in
+expected

outputs/aarch64-darwin/tests/nixpkgs-config/expr.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.darwinConfigurations) (
+  name: outputs.darwinConfigurations.${name}.config.nixpkgs.config == { }
+)