feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts

New script: scripts/secrets/push-host-keys.sh
- Pushes newly-generated SSH host keys from host-keys/ to already-running
  NixOS hosts after sync-host-keys.sh --regenerate-all-keys.
- Before pushing any key, checks that .sops.yaml and secrets/*.yaml are
  committed and pushed to the remote Gitea flake (hosts rebuild from there,
  so recipient changes must land first); offers to auto-commit/push if not.
- Reads /etc/flake-target from each host to confirm which key to install,
  handling the case where multiple flake targets share a hostname.
- Deduplicates by hostname in --all mode; skips hand-registered targets
  that have no host-keys/ entry.
- --dry-run, --skip-git-check, SSH_USER override (default: nixos).

sync-host-keys.sh --regenerate-all-keys:
- Updated pre-confirmation warning to distinguish already-running hosts
  (need push-host-keys.sh) from not-yet-deployed hosts (need installer
  image rebuild).
- Added next-steps block after regeneration completes pointing to
  push-host-keys.sh --all.

recover-hosts.sh:
- Header and SSH host key mismatch warn now cross-reference
  push-host-keys.sh as the proactive (pre-drift) alternative.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/secrets/sync-host-keys.sh

@@ -359,8 +359,11 @@ cmd_regenerate_all() {
   echo "This will remove and freshly regenerate ALL locally-managed keys:"
   printf '  %s\n' "${hosts[@]}"
   echo
-  echo "Every host above will need its new key baked into a rebuilt install"
-  echo "image/tarball before it can decrypt secrets again."
+  echo "After regenerating, each host needs its new key before it can decrypt secrets:"
+  echo "  • Already running: push the key before rebuilding:"
+  echo "      scripts/secrets/push-host-keys.sh --all"
+  echo "  • Not yet deployed: rebuild the install image with the new keys baked in"
+  echo "      (see docs/auto-installer.md)."
 
   if [[ "$dry_run" -ne 1 ]]; then
     if ! confirm_typed "REGENERATE" "Type REGENERATE to confirm: "; then
@@ -397,6 +400,16 @@ cmd_regenerate_all() {
   echo
   echo "Regenerating fresh keys for every current flake target..."
   cmd_all
+
+  echo
+  echo "Next steps:"
+  echo "  1. Commit and push .sops.yaml + secrets/ so the remote flake is current."
+  echo "  2. Push the new host key to each already-running managed host:"
+  echo "       scripts/secrets/push-host-keys.sh --all"
+  echo "     (this also prompts to commit/push if step 1 wasn't done yet)"
+  echo "  3. Run nixos-rebuild switch on each updated host."
+  echo "  4. For hosts not yet deployed, rebuild the install image (see"
+  echo "     docs/auto-installer.md)."
 }
 
 main() {