feat: log in and sudo over SSH with a CanoKey touch

The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo.

Risks to weigh:

- Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first.
- Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch.

### Verification

- `just test` exits 0; CI passed on the first commit.
- Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`.
- Not yet verified on a running host.

### Manual step after merge

Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH.

AI assistance: DeepSeek Harness (claude-opus-5-5).

Assisted-by: DeepSeek Harness (claude-opus-5-5)

vars/default.nix

@@ -1,5 +1,15 @@
 { lib }:
+let
+  # CanoKey resident SSH keys: they log in like the main keys, and they are the
+  # only keys pam_rssh accepts for sudo on servers through the forwarded agent
+  # (modules/nixos/server/ssh-agent-sudo.nix).
+  canokeySshKeys = [
+    # CanoKey Canary (backup)
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKgfNy/wJgTw6auO4RmRHR9kh1Mt5TYNkomMDFLJ4Kw6AAAADHNzaDpyeWFuNHlpbg== ryan@canokey-moe"
+  ];
+in
 {
+  inherit canokeySshKeys;
   username = "ryan";
   userfullname = "Ryan Yin";
   useremail = "xiaoyin_c@qq.com";
@@ -28,11 +38,12 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKlN+Q/GxvwxDX/OAjJHaNFEznEN4Tw4E4TwqQu/eD6 ryan@idols-ai"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwoI5MAogEa726jwwHL5EgM1X/i2A5d2pgV7i7t8fzB ryan@shoukei"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDc1PNTXzzvd93E+e9LXvnEzqgUI5gMTEF/IitvzgmL+ ryan@frieren"
-  ];
+  ]
+  ++ canokeySshKeys;
   # CanoKey U2F registrations for sudo (modules/nixos/desktop/canokey.nix).
   # Key handles and public keys only, so they are safe to commit.
   canokeyU2fKeys = [
-    # CanoKey Canary (primary)
+    # CanoKey Canary (backup)
     "DwXDxVU+NDTUZs/d2EjpsPAh4mrg7dqdg/mAozkw/mUAAdEYDZIbm8kTBUGA49wXW0ZvSpF9VNYh2w84Xz9nAIAW////+Q==,6hqEjWBJ+ueBKBJaNijNkUsmlgEHMgv0KdpprqdJjHKoU/FKpeqo12SWlvdgiIVWvqTaGfe4fNu/ckcGY5mlsA==,es256,+presence"
   ];
   secondaryAuthorizedKeys = [