fix(proxmox): embed SSH host key via NIXOS_HOST_KEYS_DIR so sops can decrypt on first boot

--pre-format-files placed the key on the QEMU builder VM's rootfs, not the
target disk. nixos-install chroots into the target and runs sshd-keygen, which
found no key in the chroot and generated a fresh (unregistered) one. sops then
could not decrypt on first boot because the key didn't match .sops.yaml, leaving
both root and nixos with '!' in /etc/shadow even after mutableUsers = false was
set (hashedPasswordFile pointed to paths sops never wrote).

Fix modules/platforms/proxmox.nix to embed the clan SSH host key in
environment.etc via NIXOS_HOST_KEYS_DIR at eval time -- the same pattern
lxc.nix uses. nixos-install's own activation places the key on the target disk,
sshd-keygen finds it already present and skips generation, and sops decrypts
correctly on first boot. Includes the same preserveSshHostKey/restoreSshHostKey
activation scripts as lxc.nix so subsequent nixos-rebuild switch calls (without
NIXOS_HOST_KEYS_DIR) don't remove the key as "obsolete" from environment.etc.

Update create-proxmox-resource.sh: switch VM builds from
  ./result-<target> --pre-format-files ... --build-memory 2048
to
  NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build --impure ... diskoImagesScript
  ./result-<target> --build-memory 2048
matching the LXC build path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ

scripts/proxmox/create-proxmox-resource.sh

@@ -302,6 +302,12 @@ platform_prefix="lxc"
 [[ -z "$cores" ]] && cores="$PROXMOX_DEFAULT_CORES"
 [[ -z "$memory" ]] && memory="$PROXMOX_DEFAULT_MEMORY_MB"
 
+if [[ "$type" == "vm" && -n "$disk_size" ]]; then
+  echo "WARNING: --disk-size is LXC-only for create mode and is ignored for VMs." >&2
+  echo "  VM disk size comes from proxmoxImageSize in variables.nix (currently ${disk_size}G was requested)." >&2
+  echo "  To expand after creation, use: --modify --vmid <n> --grow-disk <GB>" >&2
+fi
+
 # --- discover / resolve the flake target from --host --------------------
 # Emits "<target>\t<hostName>" pairs for every ${platform_prefix}-* flake
 # target -- the one source both --list and the --host lookup below read

variables.nix

@@ -166,7 +166,7 @@
   # build (modules/disko/proxmox.nix, config.system.build.diskoImagesScript
   # — see docs/proxmox-images.md). Root fills whatever's left after the ESP
   # and swap partitions within this total.
-  proxmoxImageSize = "20G";
+  proxmoxImageSize = "50G";
 
   # nix-cache's Nix store garbage collection retention
   # (modules/nix-cache/server.nix).