feat(auth): streamline SOPS authentication and network configuration

- Replace age-based key decryption with automatic SSH host key support
- Simplify SSH configuration with consolidated host entries and enhanced security settings
- Upgrade home-manager to himmelblau for Microsoft Entra ID authentication
- Remove legacy agenix inputs and consolidate secrets to essential services only
- Add Cisco Secure Client overlay for enterprise VPN capabilities
- Update secrets.yaml to minimal configuration with gitea/github/hetzner services
- Expand system packages with tun module for VPN connectivity
- Add work directory setup for user development environment

home/terminal/software/ssh.nix

@@ -1,25 +1,47 @@
 {
-  config,
   pkgs,
+  config,
   ...
 }: {
   users.users.someone.packages = with pkgs; [
     openssh
   ];
 
-  xdg.configFile."ssh/config" = {
-    source = config.sops.secrets.ssh_config.path;
-  };
+  home.file.".ssh/config".text = ''
+    AddKeysToAgent yes
+    CheckHostIP yes
+    Compression no
+    ControlMaster no
+    ControlPath ~/.ssh/master-%r@%n:%p
+    ControlPersist no
+    HashKnownHosts yes
+    IdentitiesOnly yes
+    PasswordAuthentication no
+    ForwardAgent no
+    ForwardX11 no
+    ForwardX11Trusted no
+    ServerAliveInterval 60
+    ServerAliveCountMax 3
+    UserKnownHostsFile ~/.ssh/known_hosts
 
-  home.file.".ssh/config" = {
-    source = config.xdg.configHome + "/ssh/config";
-    mutable = false;
-  };
+    Host git.severijnse.eu
+      HostName git.severijnse.eu
+      Port 222
+      User git
+      IdentityFile /run/secrets/gitea_laptop
 
-  environment.sessionVariables = {
-    SSH_AUTH_SOCK = "${config.xdg.runtimeDir}/gnupg/S.gpg-agent.ssh";
-    SSH_CONFIG = "${config.xdg.configHome}/ssh/config";
-  };
+    Host hetzner
+      HostName severijnse.eu
+      User admin
+      IdentityFile /run/secrets/hetzner_server
+
+    Host github.com
+      HostName github.com
+      User git
+      IdentityFile /run/secrets/github_laptop
+
+    Include ~/.ssh/config.d/*
+  '';
 
   systemd.user.services.ssh-agent = {
     description = "SSH agent service";