feat(keys): SSH + GPG agent via gpg-agent, pinentry-qt

Add modules/home/keys.nix (nomarchy.keys.enable, default on): one agent —
services.gpg-agent with enableSshSupport fronts SSH, so a single pinentry
handles every passphrase (GPG signing/decryption and SSH key unlocks).
pinentry-qt for a reliable native-Wayland prompt under Hyprland, themed by
Stylix's Qt config. Cache TTLs 30 min / 2 h.

SSH_AUTH_SOCK is exported by the agent's zsh integration (terminal git/ssh
is the supported path). gnome-keyring stays the Secret Service — modern
versions run no SSH agent, so there's no socket contention; screen lock
doesn't flush the agent cache.

nix flake check passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home/default.nix

@@ -18,6 +18,7 @@
     ./yazi.nix      # flagship TUI file manager, themed + plugins
     ./osd.nix       # swayosd volume/brightness OSD, themed
     ./shell.nix     # zsh + starship + bat/eza/zoxide, themed
+    ./keys.nix      # gpg-agent (fronts SSH) + pinentry-qt
   ];
 
   # Clipboard history (wl-paste watcher); browsed via the SUPER+CTRL+V