Migrate deprecated admin service to sshd + users

sshd carries the admin SSH keys and now also CA-signed host certificates
(TOFU-less verification via the shared openssh-ca); the users service
generates per-machine root passwords (share = false, no prompts).

clan.nix

@@ -25,15 +25,30 @@ in
 
   inventory.instances = {
 
-    admin = {
-      roles.default.tags.all = { };
-      roles.default.settings.allowedKeys = {
+    # Admin SSH keys + root password, split per the clan-core migration off
+    # the deprecated `admin` service (sshd handles keys, users the password).
+    sshd = {
+      roles.server.tags.all = { };
+      roles.server.settings.authorizedKeys = {
         "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENAjhGQGraQoAjJzsomKP8GAmQPeGL1rNRNHgRcLqtT";
         "kurogeek" =
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
       };
     };
 
+    root-user = {
+      module = {
+        name = "users";
+        input = "clan-core";
+      };
+      roles.default.tags.all = { };
+      roles.default.settings = {
+        user = "root";
+        prompt = false; # auto-generate, like the old admin service
+        share = false; # per-machine password, not fleet-wide
+      };
+    };
+
     zerotier = {
       roles.controller.machines."control" = { };
       roles.peer.tags.all = { };