refactor(ssh): centralize identity file logic and optimize host selection

Refactor the SSH configuration generation to reduce duplication and
improve efficiency.

- Extract `IdentityFile` line generation into a shared variable in
  `ssh-inventory.nix` to ensure consistency between per-host and
  gitea blocks.
- Optimize `selectedHosts` resolution in `home-manager/default.nix`
  by reusing `activeHosts` when the "all" wildcard is used.
- Tighten IPv4 regex matching in `ssh-inventory.nix` using anchors.
- Update `users-merge.nix` to propagate `extraIdentities` to the
  rbw outbound configuration.
- Set default `authorizedHosts` to "all" for inbound SSH users.

modules/lib/ssh-inventory.nix

@@ -57,7 +57,7 @@
       # parses as an IPv4 dotted-quad. Filters out scratchpad/non-routable
       # entries (e.g. `hostName = "test"`).
       activeHosts = lib.filterAttrs
-        (_: h: lib.match "[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+" h.hostName != null)
+        (_: h: lib.match "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$" h.hostName != null)
         hosts;
 
       # .pub filename convention. OpenSSH 7.3+ accepts a `.pub` file as
@@ -78,6 +78,10 @@
           identityAgent ? "SSH_AUTH_SOCK",
         }:
         let
+          # Shared `IdentityFile` filter line (when `user` is set). Used by
+          # both the per-host and gitea blocks so the two can't drift apart.
+          idLine = lib.optionalString (user != null) "  IdentityFile ~/${mkIdentityFileName user}\n";
+
           # Match blocks for cross-account SSH. Filter out cfg.user since
           # the matching pub is already loaded via the Host block's
           # IdentityFile line — re-emitting it would just duplicate.
@@ -97,7 +101,6 @@
             let
               e = selectedHosts.${hostName};
               hostPatterns = lib.concatStringsSep " " (e.aliases ++ [ e.hostName ]);
-              idLine = if user == null then "" else "  IdentityFile ~/${mkIdentityFileName user}\n";
             in ''
               Host ${hostPatterns}
                 HostName ${e.hostName}
@@ -114,7 +117,7 @@
               HostName 192.168.2.238
               Port 222
               User git
-            ${if user == null then "" else "  IdentityFile ~/${mkIdentityFileName user}\n"}  IdentityAgent ${identityAgent}
+            ${idLine}  IdentityAgent ${identityAgent}
               IdentitiesOnly yes
           '';
 

modules/lib/users-merge.nix

@@ -60,6 +60,7 @@
           chiasson.ssh.outbound.rbw.user = name;
           chiasson.ssh.outbound.rbw.hosts =
             if (outboundCfg.hosts or "all") == "all" then [ "all" ] else outboundCfg.hosts;
+          chiasson.ssh.outbound.rbw.extraIdentities = outboundCfg.extraIdentities or [ ];
         };
 
       mkHmUserModule =