Remove plaintext secrets, update SSH key, and upgrade to NixOS 25.11

Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/fileserver.nix

@@ -147,6 +147,9 @@
     "d /data/backup 0775 root root -"
     "d /data/backup/timemachine 0775 danlin users -"
     
+    # Secrets
+    "d /data/secrets 0700 root root -"
+
     # dj-beets project
     "d /opt/dj-beets 0755 root root -"
   ];
@@ -165,8 +168,8 @@
     volumes = [ "/data:/srv" ];
     environment = {
       TZ = "Europe/Berlin";
-      FILEBROWSER_ADMIN_PASSWORD = "CHANGE_ME";
     };
+    environmentFiles = [ "/data/secrets/filebrowser.env" ];
   };
 
   virtualisation.oci-containers.containers.gitea = {