feat(ssh): full homelab alias set on the Mac + separate interactive key

config/ssh_homelab now carries the curated alias set from ~/bin/CLAUDE.md
(pve nodes, machines, key CTs, switch, tailscale hosts). Interactive auth
uses a NEW key, id_ed25519_homelab, because the existing id_ed25519 is
rrsync-jailed on pve173 and sshd honours the first matching authorized_keys
line per key — one key can't be both a jail and a shell there.

- setup.sh generates id_ed25519_homelab (idempotent)
- backup.sh pins the jailed key: -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519
- scripts/authorize-mac-key.sh (run on steel141) appends the pubkey on every
  LAN host via claude's aliases; wired into run.sh
- bedroom alias: seth -> root (matches steel141; was undocumented)

Verified from the Mac: 12 aliases land as the right user@host; the backup key
is refused a shell by rrsync (checked with id — rrsync whitelists true);
backup.sh still runs. Offline at push time: bedroom thinkcentre seth-pi
pinail openclaw2 — re-run authorize-mac-key.sh when they're up.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

config/ssh_homelab

@@ -1,5 +1,10 @@
-# Included from ~/.ssh/config. Key ~/.ssh/id_ed25519 is generated by setup.sh;
-# only pve173 is authorized so far (rrsync-restricted, for backup.sh).
+# Included from ~/.ssh/config (setup.sh adds the Include line). Two keys, both made by setup.sh:
+#   ~/.ssh/id_ed25519_homelab  interactive — authorized on the hosts below by scripts/authorize-mac-key.sh
+#   ~/.ssh/id_ed25519          backup only — rrsync-jailed on pve173; backup.sh pins it with -i
+# They must stay separate: sshd honours the FIRST matching authorized_keys line per key, so one key
+# can't be both jailed (nightly rsync) and unrestricted (a shell) on pve173.
+
+# --- Proxmox nodes ---
 Host pve173
     HostName 192.168.0.173
     User root
@@ -12,12 +17,64 @@ Host pve197
 Host pve241
     HostName 192.168.0.241
     User root
+
+# --- Machines ---
 Host steel141
     HostName 192.168.0.141
     User seth
 Host bedroom
     HostName 192.168.0.235
+    User root
+Host vdj-rig
+    HostName 192.168.0.143
     User seth
+Host thinkcentre
+    HostName 192.168.0.211
+    User seth
+Host seth-pi
+    HostName 192.168.0.102
+    User seth
+Host pinail
+    HostName 192.168.0.203
+    User pi
+# TP-Link switch: password only (no pubkey support) — $HOMELAB_PASSWORD
+Host switch
+    HostName 192.168.0.250
+    User admin
+    PubkeyAuthentication no
+
+# --- Key CTs ---
+Host caddy
+    HostName 192.168.0.185
+    User root
+Host openclaw2
+    HostName 192.168.0.175
+    User root
+Host rtorrent
+    HostName 192.168.0.213
+    User root
+Host emby
+    HostName 192.168.0.215
+    User root
+Host mcsmanager
+    HostName 192.168.0.244
+    User root
+Host pihole
+    HostName 192.168.0.153
+    User root
+Host arr
+    HostName 192.168.0.158
+    User root
+
+# --- Tailscale-only (dead until Tailscale is logged in on the Mac — docs/manual-checklist.md) ---
+Host yoga
+    HostName 100.113.203.99
+    User seth
+Host bebop
+    HostName 100.78.2.106
+    User seth
+
 Host *
-    IdentityFile ~/.ssh/id_ed25519
+    IdentityFile ~/.ssh/id_ed25519_homelab
+    StrictHostKeyChecking accept-new
     ServerAliveInterval 30