chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt

Remove four stale age key anchors from .sops.yaml that correspond to
non-lxc build-type variants that were never deployed (or are now
superseded by their lxc-* counterparts):

  &docker   → superseded by &lxc-docker (active running host)
  &server   → superseded by &lxc-server (active running host)
  &nix-cache → superseded by &lxc-nix-cache (active running host)
  &nix-minimal → superseded by &lxc-minimal (active running host)

Also remove the secrets/docker.yaml creation_rules block entirely since
that file does not exist.

Re-encrypt secrets/common.yaml, secrets/nix-cache.yaml, and
secrets/server.yaml with sops updatekeys to drop the stale recipients.
The four removed keys can no longer decrypt these files.

Update README.md and CLAUDE.md to clarify that deployed lxc-* hosts
now use clan vars (vars/per-machine/<target>/openssh/) rather than the
gitignored host-keys/ directory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

.sops.yaml

@@ -1,9 +1,5 @@
 keys:
   - &admin age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
-  - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
-  - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
-  - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
   - &proxmox-minimal age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
   - &lxc-gui age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05
   - &baremetal-gui age1adur9g330gua4l6ndk8cqjg35qc8yxwgme6wrl2hpylcc7vxm38q05ejuy
@@ -36,10 +32,6 @@ creation_rules:
     key_groups:
       - age:
           - *admin
-          - *docker
-          - *server
-          - *nix-cache
-          - *nix-minimal
           - *proxmox-minimal
           - *lxc-gui
           - *baremetal-gui
@@ -67,7 +59,6 @@ creation_rules:
     key_groups:
       - age:
           - *admin
-          - *nix-cache
           - *linode-nix-cache
           - *lxc-nix-cache
           - *proxmox-nix-cache
@@ -76,17 +67,10 @@ creation_rules:
     key_groups:
       - age:
           - *admin
-          - *server
           - *linode-server
           - *lxc-server
           - *proxmox-server
 
-  - path_regex: secrets/docker\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *docker
-
   - path_regex: secrets/tor-relay\.yaml$
     key_groups:
       - age: