refactor(ssh): centralize identity file logic and optimize host selection

Refactor the SSH configuration generation to reduce duplication and
improve efficiency.

- Extract `IdentityFile` line generation into a shared variable in
  `ssh-inventory.nix` to ensure consistency between per-host and
  gitea blocks.
- Optimize `selectedHosts` resolution in `home-manager/default.nix`
  by reusing `activeHosts` when the "all" wildcard is used.
- Tighten IPv4 regex matching in `ssh-inventory.nix` using anchors.
- Update `users-merge.nix` to propagate `extraIdentities` to the
  rbw outbound configuration.
- Set default `authorizedHosts` to "all" for inbound SSH users.

modules/ssh/home-manager/default.nix

@@ -12,6 +12,13 @@
         else
           cfg.hosts;
       missingHosts = builtins.filter (name: !(builtins.hasAttr name inventory.hosts)) selectedHostNames;
+      # Resolve to the actual host attrs for the template. The "all" case
+      # reuses `activeHosts` directly instead of rebuilding the same attrset.
+      selectedHosts =
+        if cfg.hosts == [ "all" ] then
+          inventory.activeHosts
+        else
+          builtins.listToAttrs (map (n: { name = n; value = inventory.hosts.${n}; }) selectedHostNames);
       # All identities this HM user may authenticate AS: cfg.user ∪
       # extraIdentities. `cfg.user` can be null (e.g. user not in inventory
       # yet) — in that case the Host-block IdentityFile line is suppressed
@@ -112,7 +119,7 @@
           }
           (lib.mkIf cfg.manageSshConfig {
             home.file.".ssh/config".text = inventory.mkSshConfigTemplate {
-              selectedHosts = builtins.listToAttrs (map (n: { name = n; value = inventory.hosts.${n}; }) selectedHostNames);
+              inherit selectedHosts;
               user = cfg.user;
               inherit (cfg) extraIdentities;
             };