feat(ipa): add create-nixos-ipa-host-account script

Single command to enroll a NixOS host in FreeIPA and produce a
sops-encrypted keytab at secrets/<hostname>.keytab:
  - Adds the .sops.yaml creation rule automatically (with all registered
    platform-variant age keys as recipients)
  - SSHes to the domain controller to run ipa host-add + ipa-getkeytab
  - Refreshes the admin Kerberos ticket via `ssh -t ... kinit admin` if
    missing or expired, so no manual kinit step is needed
  - SCPs the keytab and encrypts it in-place with sops (file must be at
    secrets/<hostname>.keytab before encryption so the path-based creation
    rule matches — the common failure point when doing this manually)

Also adds HOME_DOMAIN and IPA_SERVER to scripts/env.sh, matching
variables.nix's homeDomain/ipaServer (same manual-sync pattern as
NIX_CACHE_HOST/LAN_DOMAIN).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/env.sh

@@ -88,6 +88,17 @@ export NIX_CACHE_HOST
 : "${LAN_DOMAIN:=gitea.lan.ddnsgeek.com}"
 export LAN_DOMAIN
 
+# Matches variables.nix's homeDomain -- the base LAN domain for service
+# subdomains, FreeIPA Kerberos realm, and host FQDNs.
+: "${HOME_DOMAIN:=sweet.home}"
+export HOME_DOMAIN
+
+# Matches variables.nix's ipaServer -- the FreeIPA server hostname.
+# scripts/ipa/create-nixos-ipa-host-account.sh SSHes here to run
+# ipa host-add and ipa-getkeytab.
+: "${IPA_SERVER:=domain-controller.sweet.home}"
+export IPA_SERVER
+
 # nix_extra_opts: call as a plain statement (NOT inside $(...)/<(...) --
 # that forks a subshell, and the whole point is exporting a decision back
 # into *this* shell) to populate the global NIX_OPTS array with whatever