add ylw ed25519 key: agenix access, SSH auth, rekey all secrets ...

- Add ylw's ed25519 public key to secrets.nix admins list
- Re-encrypt all .age secrets so ylw can decrypt
- Add ed25519 key to ye-lw21 authorized SSH keys

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Re-encrypt secrets with SSH recipients (not age recipients) ...

age encrypts differently for age vs SSH recipients. agenix passes
raw SSH host keys as identities, which can only decrypt SSH-recipient
stanzas. Previously used ssh-to-age conversion which created
age-recipient stanzas, causing "no identity matched" errors.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Re-encrypt secrets with correct full host public key ...

The xlab-gateway SSH public key was previously truncated
(missing AAAAC3NzaC1lZDI1NTE5 type prefix), causing agenix
decryption failures. Re-encrypted all .age files with the
correct full key. Verified decryption succeeds on target host.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add agenix-encrypted secrets and flake.lock ...

- Encrypted WireGuard keys for xlab-gateway (wgnet, skyworks, warp)
- Encrypted WireGuard PSK for wg-to-wgnet
- Placeholder skydick WireGuard secret
- Updated disko.nix with correct NVMe disk ID (MEMPEK1J016GAD)
- Generated flake.lock pinning nixpkgs 24.11, disko, agenix, deploy-rs

Co-Authored-By: Claude Opus 4.6 <[email protected]>