Remove plaintext secrets, update SSH key, and upgrade to NixOS 25.11

Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -12,7 +12,7 @@ help:
 	@echo "NixOS Infrastructure Management"
 	@echo ""
 	@echo "Targets:"
-	@echo "  make deploy                    Deploy to both gateway and fileserver"
+	@echo "  make deploy                    Deploy to gateway and fileserver"
 	@echo "  make deploy-gateway            Deploy to gateway only"
 	@echo "  make deploy-fileserver         Deploy to fileserver only"
 	@echo "  make deploy-k8s-server         Deploy to k8s-server only"
@@ -25,7 +25,7 @@ help:
 	@echo ""
 
 # Deployment targets
-deploy: deploy-gateway deploy-fileserver deploy-k8s-server
+deploy: deploy-gateway deploy-fileserver
 
 deploy-k8s-server:
 	@echo "======================================"