fix(ssh): enable key-based root login and use FQDNs for system services

Fixes backup system authentication and hostname resolution issues.

Changes:
- Change PermitRootLogin from "no" to "prohibit-password" in global SSH config
  (allows key-based root login for host-to-host backups while blocking passwords)
- Update fuchsia onsite backup to use viridian.home.arpa FQDN instead of shortname
- Update SSH knownHosts to use FQDNs (fuchsia.home.arpa, viridian.home.arpa)
  (system-level config uses FQDNs, user shortcuts remain in home-manager)

This enables the complete 3-2-1 backup strategy with automated backups working
correctly between fuchsia and viridian, and fuchsia to BorgBase.

nixos/fuchsia/services/borgbackup/onsite.nix

@@ -58,7 +58,7 @@ in {
     '';
 
     # Onsite repository configuration (backup to viridian over SSH)
-    repo = "ssh://viridian/srv/borg-repo/${hostname}";
+    repo = "ssh://viridian.home.arpa/srv/borg-repo/${hostname}";
 
     # No encryption for onsite backups (physical security assumed)
     encryption.mode = "none";