inventory: record age pubkeys for hubris + apps (Phase 3a)

First two clients have age keys issued by secrets-issuance.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

inventory.yaml

@@ -131,7 +131,7 @@ hosts:
       netbird_port: 22022      # see infrastructure/ssh-access.md
     mounts:
       - /mnt/library           # shared lvmthin
-    age_pubkey: ""             # filled by issuance on first bootstrap
+    age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 
   # ----- LXC containers (all on hubris) -----
   jellyfin:
@@ -191,14 +191,16 @@ hosts:
     role: docker-apps
     lan_ip: 192.168.8.205
     public_hosts: [artifacto.hubris.network]
-    mesh: {netbird: {fqdn: apps.netbird.selfhosted}}
+    mesh:
+      netbird: {fqdn: apps.netbird.selfhosted}
+      tailscale: {ip: 100.121.171.122}
     mounts: [/mnt/library]
     runs:
       - artifacto
       - plantuml
       - homelab-mcp           # introduced by this plan
       - secrets-issuance      # introduced by this plan
-    age_pubkey: ""
+    age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
   nextcloud:
     kind: lxc