Upgrade clan to 26.05

Bump clan-core and nixos-mailserver to 26.05 (NixOS 26.05) and adapt to
the breaking changes surfaced by nix flake check:

- mesh-hosts/clan.nix: read the new shared, instance-scoped zerotier vars
  (zerotier-ip-<machine>-zerotier, zerotier-network-zerotier); admit
  external members via the controller's native allowedIds.
- monitoring/server.nix: Grafana lost its built-in secret_key default;
  mint one via a clan generator and pass it with $__file{}.
- dns/authoritative.nix: services.resolved.extraConfig removed -> settings.
- mail.nix: SNM cert API change (x509.useACMEHost + acme extraDomainNames)
  and accounts/dkim option renames.
- docs: mesh runbook updated for the new var paths and allowedIds.

modules/monitoring/server.nix

@@ -25,6 +25,7 @@ let
   v6 = addr: "[${addr}]";
 
   adminPasswordFile = config.clan.core.vars.generators.grafana-admin.files."password".path;
+  secretKeyFile = config.clan.core.vars.generators.grafana-secret-key.files."secret-key".path;
 in
 {
   services.victoriametrics = {
@@ -95,6 +96,22 @@ in
     '';
   };
 
+  # NixOS 26.05 removed the built-in default for services.grafana's secret_key
+  # (used to sign/encrypt DB secrets). Mint our own instead of hardcoding the old
+  # upstream default. Safe to generate fresh here: the provisioned datasources
+  # carry no credentials, so nothing in Grafana's DB is encrypted with it.
+  clan.core.vars.generators.grafana-secret-key = {
+    files."secret-key" = {
+      secret = true;
+      owner = "grafana";
+      group = "grafana";
+    };
+    runtimeInputs = [ pkgs.openssl ];
+    script = ''
+      openssl rand -base64 32 | tr -d "\n" > "$out"/secret-key
+    '';
+  };
+
   services.grafana = {
     enable = true;
     # VictoriaLogs datasource plugin so journald is greppable from Grafana,
@@ -109,6 +126,7 @@ in
       security = {
         admin_user = "admin";
         admin_password = "$__file{${adminPasswordFile}}";
+        secret_key = "$__file{${secretKeyFile}}";
       };
       "auth.anonymous".enabled = false;
       users.allow_sign_up = false;