homelab: add deploy.enable option with assertion

- Add homelab.deploy.enable option (requires vault.enable)
- Create shared homelab-deploy Vault policy for all hosts
- Enable homelab.deploy on all vault-enabled hosts

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

system/homelab-deploy.nix

@@ -1,11 +1,10 @@
 { config, lib, ... }:
 
 let
-  cfg = config.vault;
   hostCfg = config.homelab.host;
 in
 {
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.homelab.deploy.enable {
     # Fetch listener NKey from Vault
     vault.secrets.homelab-deploy-nkey = {
       secretPath = "shared/homelab-deploy/listener-nkey";