Pre-seed SSH host keys so sops-nix secrets decrypt on first boot

sops-nix (in the nixos flake) derives each host's age decryption key
from its own /etc/ssh/ssh_host_ed25519_key at activation time, which
runs before systemd would otherwise generate that key on first boot
(sshd-keygen is a plain systemd service gated behind multi-user.target;
activation scripts run earlier). Without pre-seeding, secrets --
including the login password -- fail to decrypt on a fresh install's
very first boot.

- scripts/prepare-host-key.sh: run on the admin workstation before an
  install, generates the host's ed25519 keypair and prints the exact
  steps to register its derived age key in nixos/.sops.yaml and
  re-encrypt the affected secrets/*.yaml files.
- common.nix's auto-install.sh: after disko mounts /mnt and before
  nixos-install, installs a pre-seeded key from /root/host-keys/ into
  /mnt/etc/ssh/ if present, otherwise warns and asks for confirmation
  before continuing without one.
- installer.nix now imports common.nix (previously only proxmox-lxc.nix
  did), so the ISO/netboot path used for EFI VM installs gets the same
  auto-install.sh and pre-seed check, not just the LXC path.
- Also fixes a pre-existing stray backtick in the disko invocation that
  broke auto-install.sh's bash syntax entirely, independent of this
  change (found while rendering the script to verify the new logic).

README.md documents the new pre-flight workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

installer.nix

@@ -1,54 +1,11 @@
-{ pkgs, modulesPath, ... }:
+{ modulesPath, ... }:
 
 {
   imports = [
     "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+    ./common.nix
   ];
 
-
-#   networking.useDHCP = true;
-
-  time.timeZone = "Australia/Brisbane";
-
-
-  services.openssh.enable = true;
-
-  services.openssh.settings = {
-    PermitRootLogin = "yes";
-  };
-
-
-  environment.systemPackages = with pkgs; [
-    git
-    curl
-    jq
-    parted
-    e2fsprogs
-    btrfs-progs
-    util-linux
-    disko
-  ];
-
-
-#   environment.etc."auto-install.sh" = {
-#     source = ./auto-install.sh;
-#     mode = "0755";
-#   };
-
-
-#   users.users.root = {
-#     initialPassword = "nixos";
-#   };
-
-
-  users.users.nixos = {
-    isNormalUser = true;
-    extraGroups = [
-      "wheel"
-    ];
-  };
-
-
   # Only for ISO/Linode serial environments if required
   # NOT for LXC
   #
@@ -56,4 +13,11 @@
   #   "console=ttyS0,19200n8"
   # ];
 
+  # Run installer when logging in (same pattern as proxmox-lxc.nix)
+  environment.etc."bash_profile-nixos".text = ''
+    if [ -n "$PS1" ] && [ ! -e ~/.auto_install_ran ]; then
+      sudo /etc/auto-install.sh
+      touch ~/.auto_install_ran
+    fi
+  '';
 }