refactor(beszel): move KEY and TOKEN fully into enable-agent.nix

KEY (hub's SSH public key) is now stored in variables.nix as beszelHubKey
and set by enable-agent.nix — no host file ever needs to touch it.
TOKEN was already universal; this removes the last per-host beszel config.

Importing enable-agent.nix in a build type is now the only step needed to
add a new host to beszel monitoring.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hosts/ha-server-1/host.nix

@@ -16,8 +16,5 @@
     nameservers = [ vars.domainControllerIp ];
   };
 
-  # Set KEY after pairing this host with the beszel hub (see docs/beszel.md).
-  # services.beszel.agent.environment.KEY = "";
-
   system.stateVersion = "26.05";
 }