Reorganize scripts/ into secrets/, proxmox/, and lib/ subfolders

scripts/ had grown to 10 top-level scripts covering three distinct
concerns (sops/age + SSH host-key management, Proxmox deployment, and
repo-wide bootstrap/CI) with no grouping. Move the key-management scripts
(backup-admin-key.sh, rotate-admin-key.sh, prepare-host-key.sh,
sync-host-keys.sh) into scripts/secrets/, and the Proxmox scripts
(create-proxmox-resource.sh, configure-nix-cache-client.sh) into
scripts/proxmox/; leave env.sh, codex-setup.sh, codex-maintenance.sh, and
bump-nixpkgs-release.sh at the top level (frequently hand-typed or pure
shared config) and scripts/lib/ as-is.

Updates every cross-reference: each moved script's repo_root computation
(now one directory deeper), shellcheck source= directives, inter-script
paths (create-proxmox-resource.sh's call into sync-host-keys.sh and its
remote bootstrap of configure-nix-cache-client.sh on the Proxmox node),
and every doc/module mention (CLAUDE.md's Scripts section reorganized to
match, README.md, docs/auto-installer.md, docs/proxmox-images.md,
modules/installer/common.nix, modules/platforms/lxc.nix). CI workflows
need no change -- they only invoke codex-maintenance.sh, which didn't
move. Verified via bash -n, shellcheck (no new warnings beyond the
pre-existing SC1091/SC2029/SC2095 baseline), and live dry-runs of
sync-host-keys.sh --all and create-proxmox-resource.sh --list from their
new paths.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/lib/confirm.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# Shared "type X to confirm" prompt for scripts/create-proxmox-resource.sh
+# Shared "type X to confirm" prompt for scripts/proxmox/create-proxmox-resource.sh
 # (--modify, and replacing an existing --allow-duplicate-host resource) and
-# scripts/sync-host-keys.sh (--regenerate-all-keys) -- three destructive
+# scripts/secrets/sync-host-keys.sh (--regenerate-all-keys) -- three destructive
 # confirmations that all work the same way (echo the expected value back
 # exactly), kept in one place so the prompt/comparison logic can't drift.
 # Source alongside env.sh:

scripts/lib/sops-age.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Shared sops/age helpers for scripts/backup-admin-key.sh,
-# scripts/rotate-admin-key.sh, and scripts/sync-host-keys.sh -- all three
+# Shared sops/age helpers for scripts/secrets/backup-admin-key.sh,
+# scripts/secrets/rotate-admin-key.sh, and scripts/secrets/sync-host-keys.sh -- all three
 # derive an age public key from a private identity file the same way, two
 # of them resolve the same sops/age default key-file path, and two of them
 # run `sops updatekeys` the same way. Kept in one place so they can't drift

scripts/lib/ssh-host-keys.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Shared SSH-host-key / age-conversion helpers for scripts/sync-host-keys.sh
-# and scripts/prepare-host-key.sh -- both generate the same kind of key
+# Shared SSH-host-key / age-conversion helpers for scripts/secrets/sync-host-keys.sh
+# and scripts/secrets/prepare-host-key.sh -- both generate the same kind of key
 # (ed25519, no passphrase, the sops-nix age-derivation input) and convert it
 # to an age recipient the same way; kept in one place so the two can't
 # drift apart.