feat(ipa): add AuthorizedKeysCommand + enroll tailscale-router

- modules/ipa/client.nix: add AuthorizedKeysCommand so sshd fetches SSH
  public keys from IPA via sss_ssh_authorizedkeys, enabling pubkey login
  without per-host authorized_keys files

- hosts/tailscale-router/host.nix: add IPA client module + networking.domain
  so SSSD runs and wayne can authenticate on this host

- secrets/tailscale-router.keytab: sops-encrypted keytab for
  tailscale-router.sweet.home (generated by create-nixos-ipa-host-account.sh)

- .sops.yaml: creation rule for secrets/tailscale-router.keytab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ipa/client.nix

@@ -60,6 +60,14 @@ in
     cacheCredentials = true;
   };
 
+  # Fetch SSH public keys from IPA so users can log in with the key stored
+  # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
+  # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
+  services.openssh.extraConfig = ''
+    AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u
+    AuthorizedKeysCommandUser nobody
+  '';
+
   # Host keytab: pre-provisioned on the IPA server, sops-encrypted binary.
   # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
   # to IPA without running ipa-client-install.