feat: add Nebula mesh network overlay

Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).

Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
  pointing to genesis to reach the home LAN

Changes:
- modules/nixos/nebula.nix: new greg.nebula module
  - isLighthouse / isRelay options
  - unsafeRoutes option (tun.unsafe_routes)
  - routesSubnet option: enables IP forwarding + nftables masquerade NAT
    on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
  - agenix secret reference per-host (secrets/nebula/<name>.key.age)
  - opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
  greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)

network.json

@@ -16,21 +16,29 @@
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3",
       "ts": "100.70.99.91",
-      "system": "x86_64-linux"
+      "system": "x86_64-linux",
+      "nebulaIp": "10.157.0.7"
     },
     "genesis": {
       "ip": "10.42.1.5",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/CGE2rqlL2Qr0TJkwQMsHFSDkhGWlrUlvfcvcylO1n",
       "ts": "100.96.198.104",
       "system": "x86_64-linux",
-      "tags": ["router", "server"]
+      "tags": [
+        "router",
+        "server"
+      ],
+      "nebulaIp": "10.157.0.2"
     },
     "hosea": {
       "ip": "10.42.1.7",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
       "ts": "100.68.203.1",
       "system": "x86_64-linux",
-      "tags": ["server"]
+      "tags": [
+        "server"
+      ],
+      "nebulaIp": "10.157.0.3"
     },
     "icdm-root": {
       "external": true,
@@ -42,8 +50,16 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf",
       "ts": "100.84.183.79",
       "system": "x86_64-linux",
-      "systems": ["x86_64-linux", "aarch64-linux"],
-      "tags": ["builder", "kube", "server"]
+      "systems": [
+        "x86_64-linux",
+        "aarch64-linux"
+      ],
+      "tags": [
+        "builder",
+        "kube",
+        "server"
+      ],
+      "nebulaIp": "10.157.0.4"
     },
     "iso": {
       "external": true,
@@ -59,8 +75,16 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
       "ts": "100.102.186.39",
       "system": "x86_64-linux",
-      "systems": ["x86_64-linux", "aarch64-linux"],
-      "tags": ["builder", "kube", "server"]
+      "systems": [
+        "x86_64-linux",
+        "aarch64-linux"
+      ],
+      "tags": [
+        "builder",
+        "kube",
+        "server"
+      ],
+      "nebulaIp": "10.157.0.5"
     },
     "joel": {
       "external": true,
@@ -72,7 +96,11 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
       "ts": "100.109.86.8",
       "system": "x86_64-linux",
-      "tags": ["public", "server"]
+      "tags": [
+        "public",
+        "server"
+      ],
+      "nebulaIp": "10.157.0.1"
     },
     "MacBook-Pro.local": {
       "external": true,
@@ -108,8 +136,16 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0",
       "ts": "100.90.74.19",
       "system": "x86_64-linux",
-      "systems": ["x86_64-linux", "aarch64-linux"],
-      "tags": ["builder", "kube", "server"]
+      "systems": [
+        "x86_64-linux",
+        "aarch64-linux"
+      ],
+      "tags": [
+        "builder",
+        "kube",
+        "server"
+      ],
+      "nebulaIp": "10.157.0.6"
     }
   }
 }