feat(beszel): add beszel agent to tailscale-router

Wires beszel-agent into all tailscale-router variants (lxc/linode/proxmox)
by importing enable-agent.nix in the build type and host-token.nix in the
host file. Adds the sops creation rule for secrets/tailscale-router.yaml
(all three platform variants as recipients). The secrets file must be
created manually before deploying — see instructions in PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hosts/tailscale-router/host.nix

@@ -1,8 +1,19 @@
 _:
 
 {
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "tailscale-router";
+      sopsFile = ../../secrets/tailscale-router.yaml;
+    })
+  ];
+
   networking.hostName = "tailscale-router";
 
+  services.beszel.agent.environment = {
+    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
+  };
+
   # No networking.hostId: only ZFS-touching hosts (server, docker) need one
   # for pool-import safety, and this host does neither.