Migrate host-key tooling from nix-auto-installer, bake keys into images

Finishes the nix-auto-installer migration: scripts/prepare-host-key.sh
and the local host-keys/ directory (gitignored, private key material,
never committed — moved as plain files, not through git history)
weren't carried over in the initial migration.

Also implements automatic key staging, replacing the manual
scp-after-boot step:

- modules/installer/host-keys.nix reads host-keys/ via
  builtins.getEnv, which Nix silently returns as "" under normal
  (non---impure) evaluation — the module is a no-op by default, safe
  for CI, until explicitly opted into:

    NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure

  When built this way every key present gets baked into the image at
  /etc/host-keys/, and auto-install.sh installs whichever one matches
  the flake target selected at install time — no manual per-host scp.

- This deliberately includes the PXE netboot variant, even though
  pxe-boot serves it unauthenticated over LAN HTTP: accepted
  explicitly as a reasonable trade-off for a network that sits behind
  LAN-only infrastructure, not the open internet. auto-install.sh
  still falls back to /root/host-keys (manual scp) if a key isn't
  baked in, so images built without --impure keep working exactly as
  before.

- docs/auto-installer.md replaces nix-auto-installer's README,
  updated for in-repo paths and the new build flow.

Verified: normal `nix eval` (no --impure) evaluates identically across
all 19 nixosConfigurations + 4 packages with zero host-keys/* entries
(CI-unaffected); with --impure + the env var set, all three installer
variants (installer/ISO, proxmox-lxc, pxe) correctly embed every key
in host-keys/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/installer/host-keys.nix

@@ -0,0 +1,37 @@
+{ lib, ... }:
+
+let
+  # host-keys/ is gitignored (private key material must never be committed),
+  # which means flakes' git-filtered source tree can never see it via a
+  # normal relative path — referencing it at all requires stepping outside
+  # pure evaluation. builtins.getEnv is neutered to "" under normal
+  # `nix build`/`nix eval` (no error, just empty), so this whole module is a
+  # silent no-op unless the operator explicitly opts in with --impure and
+  # the env var set — safe by default, including in CI.
+  #
+  #   NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
+  #
+  # See docs/auto-installer.md.
+  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
+  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
+  hostKeysDir = /. + hostKeysDirStr;
+
+  keyFileNames =
+    if hasHostKeysDir
+    then
+      lib.filter
+        (name: lib.hasSuffix "_ssh_host_ed25519_key" name || lib.hasSuffix "_ssh_host_ed25519_key.pub" name)
+        (lib.attrNames (builtins.readDir hostKeysDir))
+    else [ ];
+in
+{
+  environment.etc = lib.listToAttrs (map
+    (name: {
+      name = "host-keys/${name}";
+      value = {
+        source = hostKeysDir + "/${name}";
+        mode = "0400";
+      };
+    })
+    keyFileNames);
+}