Fix agenix-rekey: add real uConsole host key, re-encrypt secrets

- Update uConsole hostPubkey from dummy to real SSH host key
- Add uConsole host key to keys.nix
- Add age.rekey config to lazyworkhorse
- Add SSH host key to identityPaths on both hosts
- Re-encrypt builder_key.age and gortium_password.age for both hosts

hosts/uConsole/configuration.nix

@@ -214,6 +214,10 @@
   };
 
   # ============================================================
+  age.identityPaths = [
+    "/etc/ssh/ssh_host_ed25519_key"
+  ];
+
   # agenix-rekey — automatic secret re-encryption at deploy time
   # ============================================================
   age.rekey = {
@@ -224,7 +228,7 @@
     # uConsole SSH host pubkey — for automatic rekey at build time
     # Once uConsole is deployed, replace with actual pubkey from:
     #   ssh-keyscan uConsole.local | ssh-to-age
-    hostPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq"; # dummy — replace after bootstrap
+    hostPubkey = "age1un8td4jzkhg5fm4jja7z3aznskc8hlcm8ky0j2f70tv74rulwgaqtpemn2"; # uConsole CM5 SSH host key
   };
 
   # Pipewire overlay: drop libcamera (fixes aarch64 cross-compile — rpi-pisp blocks)