inventory: record age pubkeys for hubris + apps (Phase 3a)

First two clients have age keys issued by secrets-issuance.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hosts/apps.yaml

@@ -11,6 +11,8 @@ lan_ip: 192.168.8.205
 mesh:
   netbird:
     fqdn: apps.netbird.selfhosted
+  tailscale:
+    ip: 100.121.171.122
 mesh_globals:
   primary: netbird
   accepted:
@@ -44,6 +46,7 @@ services_hosted:
   netbird_host: apps.netbird.selfhosted
   endpoint: http://apps.netbird.selfhosted:9820/issue
   note: Issues per-client age private keys. Mesh-only.
+age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 see_also:
 - containers/105-apps.md
 mcp_endpoint: http://apps.netbird.selfhosted:9810/sse

hosts/hubris.yaml

@@ -27,6 +27,7 @@ services_hosted:
   url: https://proxmox.hubris.network
   backend: hubris
   port: 8006
+age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 see_also:
 - hosts/hubris.md
 mcp_endpoint: http://apps.netbird.selfhosted:9810/sse

inventory.yaml

@@ -131,7 +131,7 @@ hosts:
       netbird_port: 22022      # see infrastructure/ssh-access.md
     mounts:
       - /mnt/library           # shared lvmthin
-    age_pubkey: ""             # filled by issuance on first bootstrap
+    age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 
   # ----- LXC containers (all on hubris) -----
   jellyfin:
@@ -191,14 +191,16 @@ hosts:
     role: docker-apps
     lan_ip: 192.168.8.205
     public_hosts: [artifacto.hubris.network]
-    mesh: {netbird: {fqdn: apps.netbird.selfhosted}}
+    mesh:
+      netbird: {fqdn: apps.netbird.selfhosted}
+      tailscale: {ip: 100.121.171.122}
     mounts: [/mnt/library]
     runs:
       - artifacto
       - plantuml
       - homelab-mcp           # introduced by this plan
       - secrets-issuance      # introduced by this plan
-    age_pubkey: ""
+    age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
   nextcloud:
     kind: lxc