feat(auth): streamline SOPS authentication and network configuration

- Replace age-based key decryption with automatic SSH host key support
- Simplify SSH configuration with consolidated host entries and enhanced security settings
- Upgrade home-manager to himmelblau for Microsoft Entra ID authentication
- Remove legacy agenix inputs and consolidate secrets to essential services only
- Add Cisco Secure Client overlay for enterprise VPN capabilities
- Update secrets.yaml to minimal configuration with gitea/github/hetzner services
- Expand system packages with tun module for VPN connectivity
- Add work directory setup for user development environment

work/himmelblau.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# Himmelblau: Microsoft Entra ID authentication for Linux
+#
+# Authenticates Linux users against the digistate.nl Entra ID tenant.
+# Users log in with their Entra ID credentials via OIDC Device Authorization
+# Grant flow (browser-based) or the native PAM orchestrator.
+#
+# Requires:
+#   - A working Entra ID tenant with digistate.nl as a verified domain
+#   - An OIDC app registration (Himmelblau client) in the tenant
+#   - Network connectivity to login.microsoftonline.com
+#
+# References:
+#   - https://himmelblau-idm.org/docs/
+#   - https://github.com/himmelblau-idm/himmelblau
+
+let
+  cfg = config.work.himmelblau;
+in {
+  options.work.himmelblau = {
+    enable = lib.mkEnableOption "Himmelblau Entra ID authentication" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.himmelblau = {
+      enable = true;
+      settings = {
+        domain = [ "digistate.nl" ];
+        # Uncomment and set to Entra ID group Object IDs or names to
+        # restrict which users can authenticate:
+        # pam_allow_groups = [ "ENTRA-GROUP-GUID-HERE" ];
+      };
+    };
+
+    # Himmelblau registers an NSS module (system.nssModules) for user/group lookups,
+    # which requires nscd to be enabled. Keep it on.
+    # services.nscd.enable = lib.mkForce false;
+
+    # Expose the aad-tool CLI for diagnostics and enrollment
+    environment.systemPackages = [
+      inputs.himmelblau.packages.${pkgs.system}.aad-tool
+    ];
+  };
+}