Extract ports, docker host, and remote-builder keys into variables.nix

Pulls the beszel hub / PVE / PBS ports, the docker-compose host's LAN
name, and the remote-builder client SSH keys out of scattered inline
literals across modules/hosts and into variables.nix as the single
source of truth, matching the existing pattern for other cross-host
references (nixCacheHost, nfsServerHost).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/beszel/enable-agent.nix

@@ -4,6 +4,6 @@
   services.beszel.agent.enable = true;
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    HUB_URL = "http://docker.${vars.homeDomain}:8090";
+    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.beszelHubPort}";
   };
 }

modules/nix-cache/server.nix

@@ -34,17 +34,10 @@
     createHome = true;
     home = "/var/lib/nixremote";
     shell = pkgs.bashInteractive;
-    # Provide remote builder public keys here (safe to commit public keys only):
-    # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
-    #
-    # Avoid absolute keyFiles paths here because they break pure flake evaluation.
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
-    ];
+    # Client public keys allowed to use this host as a remote builder —
+    # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to
+    # commit public keys only).
+    openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
   };
 
   services.openssh.enable = true;