feat(auth): streamline SOPS authentication and network configuration

- Replace age-based key decryption with automatic SSH host key support
- Simplify SSH configuration with consolidated host entries and enhanced security settings
- Upgrade home-manager to himmelblau for Microsoft Entra ID authentication
- Remove legacy agenix inputs and consolidate secrets to essential services only
- Add Cisco Secure Client overlay for enterprise VPN capabilities
- Update secrets.yaml to minimal configuration with gitea/github/hetzner services
- Expand system packages with tun module for VPN connectivity
- Add work directory setup for user development environment

work/overlay.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+{
+  # Overlay to add cisco-secure-client to pkgs
+  nixpkgs.overlays = [
+    (self: super: {
+      cisco-secure-client = super.callPackage ./pkgs/cisco-secure-client {};
+    })
+  ];
+}