ssh cert consolidation

.github/instructions/janus-host.instructions.md

@@ -24,7 +24,7 @@ When editing `modules/hosts/janus/default.nix`, preserve this composition unless
 - `nixos.mysops` with `sops.defaultSopsFile = ./secrets.yaml` for host-local encrypted CA runtime material.
 - `nixos.step-ca` to run the CA daemon and render `/etc/smallstep/ca.json` from Nix plus SOPS paths.
 - `nixos.step-client` to install Step trust bootstrap defaults and root CA material.
-- `nixos.step-ssh-host` so Janus itself participates in SSH host certificate flow.
+- `nixos.ssh-certs` so Janus itself participates in SSH host certificate flow.
 - `nixos.mtls` so Janus can issue and renew its own mTLS certificate bundle.
 
 ## Step CA Deployment Pattern
@@ -83,7 +83,7 @@ Start with the smallest check that matches the change:
 4. Rendered config: on the host, inspect `/etc/smallstep/ca.json` or `/etc/step-ca` paths without copying secret content into logs.
 5. Service health: check `systemctl status step-ca.service`, `journalctl -u step-ca.service`, and `step ca health --ca-url https://janus.john-stream.com` after trust is bootstrapped.
 6. Provisioners: use `step ca provisioner list` to confirm ACME, SSHPOP, and admin JWK availability.
-7. SSH cert flow: use `ssh-host-cert-check`, `systemctl status step-ssh-host-renew.service`, and `systemctl status step-ssh-host-renew.timer`.
+7. SSH cert flow: use `ssh-host-cert-check`, `systemctl status ssh-certs-renew.service`, and `systemctl status ssh-certs-renew.timer`.
 8. mTLS flow: use `mtls-check`, `mtls-generate`, and `systemctl status mtls-renew.timer` for host certificate renewal issues.
 
 ## Change Safety Rules