feat(keys): SSH + GPG agent via gpg-agent, pinentry-qt

Add modules/home/keys.nix (nomarchy.keys.enable, default on): one agent —
services.gpg-agent with enableSshSupport fronts SSH, so a single pinentry
handles every passphrase (GPG signing/decryption and SSH key unlocks).
pinentry-qt for a reliable native-Wayland prompt under Hyprland, themed by
Stylix's Qt config. Cache TTLs 30 min / 2 h.

SSH_AUTH_SOCK is exported by the agent's zsh integration (terminal git/ssh
is the supported path). gnome-keyring stays the Secret Service — modern
versions run no SSH agent, so there's no socket contention; screen lock
doesn't flush the agent cache.

nix flake check passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/settings.local.json

@@ -264,7 +264,8 @@
       "Bash(xargs cat)",
       "Bash(nix-instantiate --parse modules/home/rofi.nix)",
       "Bash(nix-instantiate --parse modules/home/shell.nix)",
-      "Bash(command -v nix)"
+      "Bash(command -v nix)",
+      "Bash(nix-instantiate --parse modules/home/keys.nix)"
     ]
   }
 }