update: rotate SSH access via cloud-init secret

Inject SSH public key through Terraform/cloud-init from Gitea secret so access can be rotated without rebuilding the template image.

terraform/cloud-init.tf

@@ -2,8 +2,9 @@ data "template_file" "cloud_init_global" {
   template = file("${path.module}/files/cloud_init_global.tpl")
 
   vars = {
-    hostname = "generic"
-    domain   = "home.arpa"
+    hostname       = "generic"
+    domain         = "home.arpa"
+    SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
   }
 }