Declarative nano and Keyhole WireGuard networks on Sayaka #36

Adds separate nano and Keyhole WireGuard networks on Sayaka (reef joins both), with encrypted per-host WG keys, explicit peer registrations, Keyhole + its cleartext WG interface in a Sayaka network namespace, and only Jellyfin/Flood/qBit API egress through a veth to homura. Keyhole credentials are age-encrypted and loaded through systemd, not stored in Nix JSON. Rebuild Sayaka first, then reef; no Tailscale subnet router. Reef NixOS toplevel built successfully and targeted Sayaka module evaluations passed; a full Sayaka toplevel build was blocked from reef by the existing Orpheus module referencing /home/callie/code/orpheus. No production WG deployment was done. See modules/nano-wireguard/README.md for joining future hosts.