refactor(ssh): decentralize SSH configuration to per-host services

Restructures SSH trust relationships from global to host-specific configuration
for better locality of concern and principle of least privilege.

Changes:
- Collapse nixos/common/global/ssh/ back to ssh.nix (single-file module)
- Move internal host trust (fuchsia/viridian) to per-host services/ssh/
- Split BorgBase known hosts by repository (li9kg944 for fuchsia, r7ag7x1w for viridian)
- Add viridian SSH server config to accept backup connections from fuchsia
- Add fuchsia borgbackup passphrase for offsite backups
- Configure viridian to create /srv/borg-repo/fuchsia for remote backups

This enables the 3-2-1 backup strategy with fuchsia backing up to both viridian
(onsite) and BorgBase (offsite) with proper SSH authentication.

nixos/common/global/ssh.nix

@@ -0,0 +1,17 @@
+{...}: {
+  # Global SSH server configuration baseline
+  # Host-specific trust relationships are configured in each host's services/ssh/
+
+  services.openssh = {
+    enable = true;
+
+    settings = {
+      PermitRootLogin = "no";           # Disable root login for security
+      PasswordAuthentication = false;   # Require key-based authentication
+      LogLevel = "VERBOSE";             # Enhanced logging for security auditing
+    };
+
+    ports = [22];                       # Standard SSH port
+    openFirewall = true;                # Allow SSH through firewall
+  };
+}