Fix agenix-rekey: add real uConsole host key, re-encrypt secrets

- Update uConsole hostPubkey from dummy to real SSH host key
- Add uConsole host key to keys.nix
- Add age.rekey config to lazyworkhorse
- Add SSH host key to identityPaths on both hosts
- Re-encrypt builder_key.age and gortium_password.age for both hosts

hosts/lazyworkhorse/configuration.nix

@@ -251,7 +251,9 @@
   
   # Private host ssh key managed by agenix
   age = {
-    identityPaths = paths.identities;
+    identityPaths = paths.identities ++ [
+      "/etc/ssh/ssh_host_ed25519_key"
+    ];
     secrets = {
       containers_env = {
         file = ../../secrets/containers.env.age;
@@ -585,4 +587,12 @@
     ];
   };
 
-}
+
+  # agenix-rekey configuration (for builder_key re-encryption at build time)
+  age.rekey = {
+    masterIdentities = [
+      "/home/gortium/.ssh/gortium_ssh_key"
+    ];
+  };
+
+}

hosts/uConsole/configuration.nix

@@ -214,6 +214,10 @@
   };
 
   # ============================================================
+  age.identityPaths = [
+    "/etc/ssh/ssh_host_ed25519_key"
+  ];
+
   # agenix-rekey — automatic secret re-encryption at deploy time
   # ============================================================
   age.rekey = {
@@ -224,7 +228,7 @@
     # uConsole SSH host pubkey — for automatic rekey at build time
     # Once uConsole is deployed, replace with actual pubkey from:
     #   ssh-keyscan uConsole.local | ssh-to-age
-    hostPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq"; # dummy — replace after bootstrap
+    hostPubkey = "age1un8td4jzkhg5fm4jja7z3aznskc8hlcm8ky0j2f70tv74rulwgaqtpemn2"; # uConsole CM5 SSH host key
   };
 
   # Pipewire overlay: drop libcamera (fixes aarch64 cross-compile — rpi-pisp blocks)