nix-cache02: add Harmonia binary cache service

- Parameterize harmonia.nix to use hostname-based Vault paths
- Add nix-cache services to nix-cache02
- Add Vault secret and variable for nix-cache02 signing key
- Add nix-cache02 public key to trusted-public-keys on all hosts
- Update plan doc to remove actions runner references

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/nix-cache/harmonia.nix

@@ -1,7 +1,7 @@
 { pkgs, config, ... }:
 {
   vault.secrets.cache-secret = {
-    secretPath = "hosts/nix-cache01/cache-secret";
+    secretPath = "hosts/${config.networking.hostName}/cache-secret";
     extractKey = "key";
     outputDir = "/run/secrets/cache-secret";
     services = [ "harmonia" ];