Prompt for a host-key path interactively as a third fallback

If neither /etc/host-keys nor /root/host-keys has the target's SSH
host key, auto-install.sh previously went straight to "continue
without one anyway?". Added a third option in between, gated on
[[ -t 0 ]] (only offered when there's an actual operator at stdin, never
in an unattended/non-interactive run): prompt for an arbitrary
directory (USB stick, other mount, etc.), and if the key pair is
there, copy it into /root/host-keys and install it to /mnt same as the
existing pre-seeded-key path. Falls through to the original
warning+confirm if the prompt is skipped, the path doesn't have the
key, or the run isn't interactive at all.

docs/auto-installer.md updated to mention the new fallback. Quick
bash -n + shellcheck pass only, per request.

scripts/installer/auto-install.sh

@@ -114,15 +114,37 @@ elif [[ -f "/root/host-keys/${choice}_ssh_host_ed25519_key" ]]; then
     install -D -m 0600 "/root/host-keys/${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
     install -D -m 0644 "/root/host-keys/${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
 else
-    echo "WARNING: no SSH host key found for ${choice} (checked /etc/host-keys and /root/host-keys)"
-    echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
-    echo "Run scripts/secrets/prepare-host-key.sh for host ${choice} on your admin workstation first,"
-    echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, or scp the result to"
-    echo "/root/host-keys/ on this machine."
-    read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
-    if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
-        echo "Aborted."
-        exit 1
+    # Third place a key can come from: an arbitrary path the operator
+    # points at interactively (e.g. a USB stick, a mount from another
+    # machine) -- only offered when there's an actual human at the other
+    # end of stdin to ask, never in a non-interactive run.
+    key_copied=0
+    if [[ -t 0 ]]; then
+        echo "No SSH host key found for ${choice} (checked /etc/host-keys and /root/host-keys)."
+        read -rp "Path to a directory containing ${choice}_ssh_host_ed25519_key(.pub) (blank to skip): " key_src_dir
+        if [[ -n "$key_src_dir" && -f "${key_src_dir}/${choice}_ssh_host_ed25519_key" && -f "${key_src_dir}/${choice}_ssh_host_ed25519_key.pub" ]]; then
+            cp "${key_src_dir}/${choice}_ssh_host_ed25519_key" "${key_src_dir}/${choice}_ssh_host_ed25519_key.pub" /root/host-keys/
+            key_copied=1
+        elif [[ -n "$key_src_dir" ]]; then
+            echo "WARNING: ${choice}_ssh_host_ed25519_key(.pub) not found in ${key_src_dir}."
+        fi
+    fi
+
+    if [[ "$key_copied" -eq 1 ]]; then
+        echo "Copied SSH host key for ${choice} from ${key_src_dir}, installing to target..."
+        install -D -m 0600 "/root/host-keys/${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+        install -D -m 0644 "/root/host-keys/${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+    else
+        echo "WARNING: no SSH host key found for ${choice} (checked /etc/host-keys and /root/host-keys)"
+        echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
+        echo "Run scripts/secrets/prepare-host-key.sh for host ${choice} on your admin workstation first,"
+        echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, scp the result to"
+        echo "/root/host-keys/ on this machine, or point at it when prompted above."
+        read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
+        if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
+            echo "Aborted."
+            exit 1
+        fi
     fi
 fi