nix-cache02: add Harmonia binary cache service

- Parameterize harmonia.nix to use hostname-based Vault paths
- Add nix-cache services to nix-cache02
- Add Vault secret and variable for nix-cache02 signing key
- Add nix-cache02 public key to trusted-public-keys on all hosts
- Update plan doc to remove actions runner references

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/plans/nix-cache-reprovision.md

@@ -59,7 +59,6 @@ The `homelab-deploy` tool was extended with a builder mode:
 ### Old System (nix-cache01)
 - Still running at 10.69.13.15
 - Serves binary cache via Harmonia
-- Runs Gitea Actions runner
 - Has the old `build-flakes.sh` timer (every 30 min)
 - Will be decommissioned after nix-cache02 is fully validated
 
@@ -69,7 +68,6 @@ The `homelab-deploy` tool was extended with a builder mode:
 - Metrics exposed on port 9973 (`homelab-deploy-builder` job)
 - Does NOT yet have:
   - Harmonia (binary cache server)
-  - Actions runner
   - Cache signing key
 
 ## Remaining Work
@@ -84,10 +82,9 @@ The `homelab-deploy` tool was extended with a builder mode:
 ### Phase 4: Complete Migration
 
 1. **Add Harmonia to nix-cache02** - Copy cache signing key, configure service
-2. **Add Actions runner to nix-cache02** - Configure with Vault token
-3. **Update DNS** - Point `nix-cache.home.2rjus.net` to nix-cache02
-4. **Increase RAM** - Bump to 24GB after nix-cache01 is gone
-5. **Decommission nix-cache01**:
+2. **Update DNS** - Point `nix-cache.home.2rjus.net` to nix-cache02
+3. **Increase RAM** - Bump to 24GB after nix-cache01 is gone
+4. **Decommission nix-cache01**:
    - Remove from `terraform/vms.tf`
    - Remove old build script (`services/nix-cache/build-flakes.nix`, `build-flakes.sh`)
    - Archive or delete host config
@@ -145,5 +142,4 @@ Available metrics:
 ## Open Questions
 
 - [ ] When to cut over DNS from nix-cache01 to nix-cache02?
-- [ ] Keep Actions runner on nix-cache02 or separate host?
 - [ ] Implement safe flake update workflow before or after full migration?