Replace all instances of config.krebs.users.lass.pubkey with hardware keys:
- self.keys.ssh.yubi_pgp
- self.keys.ssh.yubi1
- self.keys.ssh.yubi2
- self.keys.ssh.solo2

- Rename yubi.pgp to yubi_pgp.pgp
- Rename yubi.ssh to yubi_pgp.ssh
- Update all references in flake-module.nix, barnacle configuration, and yubikey.nix

- Make pass-otp accept OTP secrets via stdin or args instead of calling passage directly
- Update pass wrapper to pipe password content to pass-otp
- Remove redundant PATH export for age plugins (already in runtimeInputs)

- Add yubi2 age public key generated with age-plugin-yubikey
- Add yubi2 SSH ed25519-sk public key
- Store SSH private key encrypted with age
- Required enabling FIDO2 USB interface on YubiKey

- Add yubi1 age public key generated with age-plugin-yubikey
- Add yubi1 SSH ed25519-sk public key
- Store SSH private key encrypted with age
- Update ssh-with-age to support age-plugin-yubikey decryption
- Tool now supports Solo 2, Secure Enclave, and YubiKey devices