Pre-seed SSH host keys so sops-nix secrets decrypt on first boot

sops-nix (in the nixos flake) derives each host's age decryption key
from its own /etc/ssh/ssh_host_ed25519_key at activation time, which
runs before systemd would otherwise generate that key on first boot
(sshd-keygen is a plain systemd service gated behind multi-user.target;
activation scripts run earlier). Without pre-seeding, secrets --
including the login password -- fail to decrypt on a fresh install's
very first boot.

- scripts/prepare-host-key.sh: run on the admin workstation before an
  install, generates the host's ed25519 keypair and prints the exact
  steps to register its derived age key in nixos/.sops.yaml and
  re-encrypt the affected secrets/*.yaml files.
- common.nix's auto-install.sh: after disko mounts /mnt and before
  nixos-install, installs a pre-seeded key from /root/host-keys/ into
  /mnt/etc/ssh/ if present, otherwise warns and asks for confirmation
  before continuing without one.
- installer.nix now imports common.nix (previously only proxmox-lxc.nix
  did), so the ISO/netboot path used for EFI VM installs gets the same
  auto-install.sh and pre-seed check, not just the LXC path.
- Also fixes a pre-existing stray backtick in the disko invocation that
  broke auto-install.sh's bash syntax entirely, independent of this
  change (found while rendering the script to verify the new logic).

README.md documents the new pre-flight workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -199,7 +199,12 @@ The generated `/etc/auto-install.sh` performs the following steps:
 
 6. Prepare `/mnt` using the Disko-generated mount configuration.
 
-7. Install NixOS:
+7. Check for a pre-seeded SSH host key at `/root/host-keys/<host>_ssh_host_ed25519_key`
+   and install it to `/mnt/etc/ssh/` if present (see "Pre-Seeding SSH Host
+   Keys for sops-nix" below) — prompts for confirmation before continuing
+   without one.
+
+8. Install NixOS:
 
    ```sh
    nixos-install \
@@ -207,9 +212,48 @@ The generated `/etc/auto-install.sh` performs the following steps:
      --no-root-password
    ```
 
-8. Remove temporary installation files.
+9. Remove temporary installation files.
 
-9. Reboot.
+10. Reboot.
+
+## Pre-Seeding SSH Host Keys for sops-nix
+
+The `nixos` flake manages secrets with sops-nix, using an age key derived
+from each host's own `/etc/ssh/ssh_host_ed25519_key`. That key is normally
+generated by a systemd service (`sshd-keygen`) the first time a host boots
+— but sops-nix decrypts secrets (including the login password) earlier
+than that, during system *activation*, which runs before systemd starts
+pursuing the target that `sshd-keygen` is gated behind. On a genuinely
+fresh install, this means secrets fail to decrypt on the very first boot
+unless the host key already exists beforehand.
+
+To avoid this, generate the key ahead of time and register it with the
+`nixos` flake's sops-nix setup **before** installing:
+
+```sh
+./scripts/prepare-host-key.sh <hostname> [path-to-nixos-repo]
+```
+
+This generates `host-keys/<hostname>_ssh_host_ed25519_key(.pub)` locally
+and prints the exact steps to add its derived age key to `nixos/.sops.yaml`,
+re-encrypt the relevant `secrets/*.yaml` files with `sops updatekeys`, and
+commit + push the `nixos` repo.
+
+Once that's done and the target machine is booted into the installer,
+copy the generated key onto it before running (or continuing)
+`/etc/auto-install.sh`:
+
+```sh
+scp host-keys/<hostname>_ssh_host_ed25519_key{,.pub} root@<target-ip>:/root/host-keys/
+```
+
+`auto-install.sh` checks for this file automatically and installs it to
+the target's `/mnt/etc/ssh/` before running `nixos-install`. If it's
+missing, the script warns and asks for confirmation before continuing —
+useful for hosts that don't consume any sops-nix secrets, but skipping it
+for a host that does will lock secrets out of decrypting on first boot.
+
+`host-keys/` is gitignored — never commit private key material.
 
 ## Configuration Notes