Replace all instances of config.krebs.users.lass.pubkey with hardware keys:
- self.keys.ssh.yubi_pgp
- self.keys.ssh.yubi1
- self.keys.ssh.yubi2
- self.keys.ssh.solo2

- Rename yubi.pgp to yubi_pgp.pgp
- Rename yubi.ssh to yubi_pgp.ssh
- Update all references in flake-module.nix, barnacle configuration, and yubikey.nix

- Make pass-otp accept OTP secrets via stdin or args instead of calling passage directly
- Update pass wrapper to pipe password content to pass-otp
- Remove redundant PATH export for age plugins (already in runtimeInputs)

- Add yubi2 age public key generated with age-plugin-yubikey
- Add yubi2 SSH ed25519-sk public key
- Store SSH private key encrypted with age
- Required enabling FIDO2 USB interface on YubiKey

- Add yubi1 age public key generated with age-plugin-yubikey
- Add yubi1 SSH ed25519-sk public key
- Store SSH private key encrypted with age
- Update ssh-with-age to support age-plugin-yubikey decryption
- Tool now supports Solo 2, Secure Enclave, and YubiKey devices

- Add Solo 2 age public key for FIDO2 device
- Add Solo 2 SSH ed25519-sk public key
- Store SSH private key encrypted with age for secure storage
- Update keys flake-module to handle encrypted SSH private keys safely
- Add ssh-with-age tool for auto-detecting and using encrypted SSH keys
- Tool uses only repository keys, no home directory dependencies
- Auto-detects matching FIDO2 device by trying each encrypted key