feat(neogaia): restore the SSH host keys from sops (task 0011)

The host's SSH identity was generated by the daemon, so reimaging the
laptop would invalidate it and break `known_hosts` for every client that
had ever connected.

Add `secrets/neogaia.yaml`, the first per-host secrets file, encrypted to
the admin identity and `neogaia` alone so a compromised machine cannot
decrypt another's material. It holds both host private keys; the public
halves are committed in plaintext.

Clear `services.openssh.hostKeys` to stop generation and point `HostKey`
at the decrypted paths. These are ordinary secrets rather than the
pre-user ones the password uses, exercising the second decryption path.

.sops.yaml

@@ -9,6 +9,15 @@ keys:
   - &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
 
 creation_rules:
+  # Material belonging to one machine.
+  # No machine other than the one named is a recipient, so a host that is
+  # compromised cannot decrypt another's material.
+  - path_regex: secrets/neogaia\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *neogaia
+
   # Material common to every machine, so it is stored once rather than per host.
   - path_regex: secrets/shared\.yaml$
     key_groups: