feat: add Nebula mesh network overlay

Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).

Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
  pointing to genesis to reach the home LAN

Changes:
- modules/nixos/nebula.nix: new greg.nebula module
  - isLighthouse / isRelay options
  - unsafeRoutes option (tun.unsafe_routes)
  - routesSubnet option: enables IP forwarding + nftables masquerade NAT
    on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
  - agenix secret reference per-host (secrets/nebula/<name>.key.age)
  - opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
  greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)

secrets/secrets.nix

@@ -137,4 +137,14 @@ in
   "compose/attic.env.age".publicKeys = everyone;
 
   "grafana-api-token.age".publicKeys = everyone;
+
+  # Nebula mesh network — one private key per host, encrypted to that host's
+  # system key + all user keys so Greg can (re)encrypt them from any machine.
+  "nebula/genesis.key.age".publicKeys = everyone;
+  "nebula/hosea.key.age".publicKeys = everyone;
+  "nebula/isaiah.key.age".publicKeys = everyone;
+  "nebula/jeremiah.key.age".publicKeys = everyone;
+  "nebula/linode.key.age".publicKeys = everyone;
+  "nebula/zeke.key.age".publicKeys = everyone;
+  "nebula/exodus.key.age".publicKeys = everyone;
 }