fix(ssh): give ssh-agent askpass env for verify-required sk keys

The agent, not the client, collects the FIDO PIN when signing with an
agent-held verify-required `sk-ssh-ed25519` key. Its systemd user service
started with a minimal env lacking `SSH_ASKPASS`, so those signatures failed
as "incorrect passphrase supplied to decrypt private key". Set `SSH_ASKPASS`
and `SSH_ASKPASS_REQUIRE=force` on the unit so the agent can pop pinentry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home.nix

@@ -548,6 +548,17 @@ in
   # gpg's ssh support is off, so this is the only agent. Keys are added on
   # demand — nothing here presumes a particular ssh config.
   services.ssh-agent.enable = true;
+  # The agent, not the ssh client, collects the FIDO PIN when signing with a
+  # verify-required sk-ed25519 key it holds — so the *agent's* environment needs
+  # the askpass helper. The systemd user service starts with a minimal env that
+  # lacks it, so such signatures fail with the misleading "incorrect passphrase
+  # supplied to decrypt private key". REQUIRE=force drives the prompt with no
+  # DISPLAY (a daemon has none); sshAskpass exits 0 for the touch step, so only
+  # the PIN pops a dialog.
+  systemd.user.services.ssh-agent.Service.Environment = [
+    "SSH_ASKPASS=${sshAskpass}"
+    "SSH_ASKPASS_REQUIRE=force"
+  ];
 
   services.mako = {
     enable = true;