- Add age key identity paths to secrets module - Create wireguard-key secrets for both hosts - Switch wireguard.nix to privateKeyFile pointing to age secrets - Add Makefile with agenix targets (key generation, edit, rekey)