fix(ssh): enable key-based root login and use FQDNs for system services

Fixes backup system authentication and hostname resolution issues.

Changes:
- Change PermitRootLogin from "no" to "prohibit-password" in global SSH config
  (allows key-based root login for host-to-host backups while blocking passwords)
- Update fuchsia onsite backup to use viridian.home.arpa FQDN instead of shortname
- Update SSH knownHosts to use FQDNs (fuchsia.home.arpa, viridian.home.arpa)
  (system-level config uses FQDNs, user shortcuts remain in home-manager)

This enables the complete 3-2-1 backup strategy with automated backups working
correctly between fuchsia and viridian, and fuchsia to BorgBase.

nixos/viridian/services/ssh/default.nix

@@ -4,14 +4,14 @@
     "${inputs.self}/nixos/fuchsia/ssh_host_ed25519_key.pub"
   );
 in {
-  # Trust fuchsia's host keys for SSH connections
+  # Trust fuchsia's host keys for SSH connections (system-level, uses FQDN)
   programs.ssh.knownHosts = {
     "fuchsia-ed25519" = {
-      hostNames = ["fuchsia"];
+      hostNames = ["fuchsia.home.arpa"];
       publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_ed25519_key.pub";
     };
     "fuchsia-rsa" = {
-      hostNames = ["fuchsia"];
+      hostNames = ["fuchsia.home.arpa"];
       publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_rsa_key.pub";
     };
   };