Upgrade clan to 26.05

Bump clan-core and nixos-mailserver to 26.05 (NixOS 26.05) and adapt to
the breaking changes surfaced by nix flake check:

- mesh-hosts/clan.nix: read the new shared, instance-scoped zerotier vars
  (zerotier-ip-<machine>-zerotier, zerotier-network-zerotier); admit
  external members via the controller's native allowedIds.
- monitoring/server.nix: Grafana lost its built-in secret_key default;
  mint one via a clan generator and pass it with $__file{}.
- dns/authoritative.nix: services.resolved.extraConfig removed -> settings.
- mail.nix: SNM cert API change (x509.useACMEHost + acme extraDomainNames)
  and accounts/dkim option renames.
- docs: mesh runbook updated for the new var paths and allowedIds.

clan.nix

@@ -1,18 +1,5 @@
 let
   hosts = import ./modules/hosts.nix;
-
-  # This clan-core pins the zerotier `allowedIps` interface (admit by network
-  # IPv6), but node IDs are the stable per-device handle (what `zerotier-cli
-  # info` prints). Derive a member's IP on THIS network from the controller's
-  # network id so external members can be listed by node id, as below.
-  ztNetworkId = builtins.readFile ./vars/per-machine/control/zerotier/zerotier-network-id/value;
-  ztMemberIp =
-    nodeId:
-    let
-      full = "fd" + ztNetworkId + "9993" + nodeId;
-      h = i: builtins.substring (i * 4) 4 full;
-    in
-    "${h 0}:${h 1}:${h 2}:${h 3}:${h 4}:${h 5}:${h 6}:${h 7}";
 in
 {
   # Ensure this is unique among all clans you want to use.
@@ -44,7 +31,7 @@ in
       # External members admitted by ZeroTier node id (stable per device).
       # Inventory machines are auto-accepted; this is only for peers outside the
       # clan. Node id comes from `zerotier-cli info` on the joining device.
-      roles.controller.settings.allowedIps = map ztMemberIp [
+      roles.controller.settings.allowedIds = [
         "8802c8d7e0" # alex-nixos
         "2bd36db8cc" # kurogeek-thinkpad
       ];