Pre-seed SSH host keys so sops-nix secrets decrypt on first boot

sops-nix (in the nixos flake) derives each host's age decryption key
from its own /etc/ssh/ssh_host_ed25519_key at activation time, which
runs before systemd would otherwise generate that key on first boot
(sshd-keygen is a plain systemd service gated behind multi-user.target;
activation scripts run earlier). Without pre-seeding, secrets --
including the login password -- fail to decrypt on a fresh install's
very first boot.

- scripts/prepare-host-key.sh: run on the admin workstation before an
  install, generates the host's ed25519 keypair and prints the exact
  steps to register its derived age key in nixos/.sops.yaml and
  re-encrypt the affected secrets/*.yaml files.
- common.nix's auto-install.sh: after disko mounts /mnt and before
  nixos-install, installs a pre-seeded key from /root/host-keys/ into
  /mnt/etc/ssh/ if present, otherwise warns and asks for confirmation
  before continuing without one.
- installer.nix now imports common.nix (previously only proxmox-lxc.nix
  did), so the ISO/netboot path used for EFI VM installs gets the same
  auto-install.sh and pre-seed check, not just the LXC path.
- Also fixes a pre-existing stray backtick in the disko invocation that
  broke auto-install.sh's bash syntax entirely, independent of this
  change (found while rendering the script to verify the new logic).

README.md documents the new pre-flight workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

common.nix

@@ -105,11 +105,35 @@ fi
     
 if nix eval --refresh --json  --extra-experimental-features "flakes nix-command" "''${FLAKE_BASE_URL}#nixosConfigurations.''${choice}.config.disko.devices.disk.main.device" >/dev/null 2>&1; then
     disko --mode destroy,format,mount \
-        --flake "''${FLAKE_BASE_URL}#''${choice}" --yes`
+        --flake "''${FLAKE_BASE_URL}#''${choice}" --yes
 else
     echo "Selected host has no Disko configuration."
 fi
 
+# sops-nix derives this host's decryption key from its own SSH host key
+# at *activation* time, which runs before systemd would otherwise
+# generate one on first boot. Without pre-seeding it here, secrets
+# (including the login password) fail to decrypt on first boot.
+# Generate the key + register it with `nixos`'s sops-nix setup ahead of
+# time (see nix-auto-installer/scripts/prepare-host-key.sh), then scp it
+# to /root/host-keys/ on this machine before continuing.
+mkdir -p /root/host-keys
+if [[ -f "/root/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
+    echo "Found pre-seeded SSH host key for ''${choice}, installing to target..."
+    install -D -m 0600 "/root/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+    install -D -m 0644 "/root/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+else
+    echo "WARNING: no pre-seeded host key found at /root/host-keys/''${choice}_ssh_host_ed25519_key"
+    echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
+    echo "Run scripts/prepare-host-key.sh for host ''${choice} on your admin workstation first,"
+    echo "then scp the result here, if this host needs sops-nix secrets."
+    read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
+    if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
+        echo "Aborted."
+        exit 1
+    fi
+fi
+
 mkdir -p /mnt/install-tmp
 export TMPDIR=/mnt/install-tmp