Remove plaintext secrets, update SSH key, and upgrade to NixOS 25.11

Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/common.nix

@@ -26,9 +26,9 @@
   users.users.danlin = {
     isNormalUser = true;
     extraGroups = [ "wheel" ];
-    initialPassword = "changeme";
+    hashedPassword = "$6$tvQ8UVAZIOm4g8PI$u1HBwK1xVINiNFOm.MtbvGsXb8R5SvBHqdJpTLcvDHJcdWa4GcB/R3txARlu.s/bLhtnwoKSKUksQ5ETwyQ5u.";
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+xf0lrobmWxml003CyjzEEZqUf2qbEv6vEGMGNUBAX danlin@MacBook-Pro-von-Daniel.fritz.box"
     ];
   };
 

modules/fileserver.nix

@@ -147,6 +147,9 @@
     "d /data/backup 0775 root root -"
     "d /data/backup/timemachine 0775 danlin users -"
     
+    # Secrets
+    "d /data/secrets 0700 root root -"
+
     # dj-beets project
     "d /opt/dj-beets 0755 root root -"
   ];
@@ -165,8 +168,8 @@
     volumes = [ "/data:/srv" ];
     environment = {
       TZ = "Europe/Berlin";
-      FILEBROWSER_ADMIN_PASSWORD = "CHANGE_ME";
     };
+    environmentFiles = [ "/data/secrets/filebrowser.env" ];
   };
 
   virtualisation.oci-containers.containers.gitea = {