sops-encrypt TURN password + Authentik client secret; homelab render-vps-configs

The IONOS netbird VPS held two credentials in plaintext that were the last
holdouts from the homelab's sops+age secrets pattern:
  - /root/turn-pass.txt  (coturn long-term-credential password)
  - PKCEAuthorizationFlow.ProviderConfig.ClientSecret inline in
    /opt/management.json (Authentik OIDC client secret)

This commit moves both into sops-encrypted YAML in the repo and adds a render
command that recreates the VPS config files from templates + decrypted secrets:

* secrets/turn-shared-secret.yaml      — encrypted `password: <coturn pwd>`
* secrets/netbird-authentik-oidc.yaml  — encrypted `client_secret: <...>`
  Both recipients = hubris + apps + republic-laptop (same 3 as hello.yaml).
* vps/turnserver.conf.tmpl + vps/management.json.tmpl — templates with
  {{TURN_PASSWORD}} + {{AUTHENTIK_CLIENT_SECRET}} placeholders.
* bin/homelab new subcommand `render-vps-configs`:
  - Decrypts both secrets locally (works on any recipient).
  - Substitutes placeholders into templates.
  - Diffs against current VPS state via ssh, prompts, applies atomically
    (write `.new` then mv), restarts coturn + netbird-mgmt.
  - --dry-run + -y flags. Hops through hubris when not running on hubris
    itself, since VPS sshd is locked to hubris's pubkey.
* inventory.yaml adds the VPS as `kind: external` (new kind; reserved for
  ssh-managed hosts that aren't homelab clients themselves — no age key,
  no /opt/homelab-context). hosts/netbird-vps.yaml regenerated.
* SHARED_SECRETS list includes both new secrets so re-keys on enrollment
  changes pick them up automatically.

After this lands + the 5-min sync propagates to hubris, run from hubris PVE
shell (or any client; hubris just skips the extra ssh hop):

  homelab render-vps-configs --dry-run    # see plan, no changes
  homelab render-vps-configs -y           # apply + restart services

Once verified working, the plaintext `/root/turn-pass.txt` should be deleted
on the VPS (the rendered /etc/turnserver.conf no longer needs it as a
reference).

inventory.yaml

@@ -7,7 +7,10 @@
 #   - hostname keys MUST match the actual `hostname` of the machine (on
 #     macOS: `scutil --get LocalHostName` if set).
 #   - `os:` one of: linux, macos
-#   - `kind:` one of: proxmox-host, lxc, vm, workstation
+#   - `kind:` one of: proxmox-host, lxc, vm, workstation, external
+#     ("external" is reserved for hosts the homelab CLI manages via ssh but
+#      that aren't homelab clients themselves — e.g. the IONOS netbird VPS
+#      with no /etc/age/key.txt and no /opt/homelab-context clone.)
 #   - `mesh:` lists addresses the host is reachable at. Both `netbird` and
 #     `tailscale` are accepted during the migration (see infrastructure/mesh.md).
 #     Prefer netbird FQDNs over raw IPs.
@@ -360,3 +363,24 @@ hosts:
     # ssh.user defaults to root; uncomment + set to the actual login user
     # before relying on `homelab ssh ludo-mini` or netbird-ssh INTO this host.
     # ssh: { user: ludo }
+  netbird-vps:
+    kind: external
+    os: linux
+    role: netbird-mgmt
+    mesh:
+      netbird:
+        ip: 100.122.165.149
+        fqdn: netbird-ionos.netbird.selfhosted
+    ssh:
+      user: root
+    notes:
+    - Public IONOS VPS — hosts the vanilla netbird mgmt+signal+relay+dashboard
+      stack + host coturn (see infrastructure/vps-hardening.md +
+      infrastructure/mesh.md changelog 2026-05-21).
+    - NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context
+      clone. Managed via ssh from hubris; sshd is locked to hubris's pubkey.
+    - Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
+    - Configs rendered by `homelab render-vps-configs` from
+      vps/turnserver.conf.tmpl + vps/management.json.tmpl, with secrets
+      decrypted from secrets/turn-shared-secret.yaml +
+      secrets/netbird-authentik-oidc.yaml on hubris.