Add agenix-rekey module + rekey config back to lazyworkhorse

agenix-rekey auto-re-encrypts secrets per host at build time:
- Encrypted once in git with master identity
- Re-encrypted for each host using their SSH host key
- No manual multi-recipient encryption needed

hosts/lazyworkhorse/configuration.nix

@@ -588,4 +588,10 @@
   };
 
 
-}
+}
+  # agenix-rekey — automatic re-encryption for each target host
+  age.rekey = {
+    masterIdentities = [
+      "/home/gortium/.ssh/gortium_ssh_key"
+    ];
+  };