nix-cache02: add Harmonia binary cache service

- Parameterize harmonia.nix to use hostname-based Vault paths
- Add nix-cache services to nix-cache02
- Add Vault secret and variable for nix-cache02 signing key
- Add nix-cache02 public key to trusted-public-keys on all hosts
- Update plan doc to remove actions runner references

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

terraform/vault/secrets.tf

@@ -75,12 +75,17 @@ locals {
       data          = { private_key = var.wireguard_private_key }
     }
 
-    # Nix cache signing key
+    # Nix cache signing keys
     "hosts/nix-cache01/cache-secret" = {
       auto_generate = false
       data          = { key = var.cache_signing_key }
     }
 
+    "hosts/nix-cache02/cache-secret" = {
+      auto_generate = false
+      data          = { key = var.cache_signing_key_02 }
+    }
+
     # Homelab-deploy NKeys
     "shared/homelab-deploy/listener-nkey" = {
       auto_generate = false

terraform/vault/variables.tf

@@ -41,11 +41,18 @@ variable "wireguard_private_key" {
 }
 
 variable "cache_signing_key" {
-  description = "Nix binary cache signing key"
+  description = "Nix binary cache signing key (nix-cache01)"
   type        = string
   sensitive   = true
 }
 
+variable "cache_signing_key_02" {
+  description = "Nix binary cache signing key (nix-cache02)"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+
 variable "homelab_deploy_listener_nkey" {
   description = "NKey seed for homelab-deploy listeners"
   type        = string