Harden authorized_keys role with always-present admin keys

[fe51]

pitch

Makes the authorized_keys role safe to run with exclusive: true, and
extends SSH key syncing to the server hosts.

issue

The role enforces exclusive: true, which removes any key not in the list.
Nothing guaranteed our own access key stayed in that set — an empty or
mistaken ssh_authorized_keys (or a missing .pub) could silently lock us
out of a host.

Aslo The role was also only wired into engine/Pi setup, so
alert_server / platform_react_server never had their keys enforced at
deploy time.

Changes

• ssh_admin_keys (new): trusted admin/backup keys, always appended on
  top of ssh_authorized_keys. Guarantees these keys survive exclusive: true.
  Set once in group_vars/all/vars.yml, so per-host lists only carry
  user-specific accesses (no more repeating the trusted team everywhere).
• Fail fast before touching authorized_keys:
  • refuse to run if ssh_admin_keys is empty (lockout guard);
  • refuse to run if any referenced .pub is missing on the controller,
    with a clear message instead of a cryptic lookup error.
• deploy-servers.yml: sync authorized keys on alert_server and
  platform_react_server during deploy.

[MateoLostanlen]

Hey @fe51 , one issue with the preflight checks: the run_once: true on the "Check that every referenced public key file exists" and "Fail if any referenced public key file is missing" tasks should be removed.

With run_once, the check runs only once, using the key list of the first host of the play. But ssh_authorized_keys is a per-group variable, so the other hosts' keys are never checked.

Step by step with make sync-ssh-keys (hosts: all) and the pi-manager-fr#65 inventory:

1. First host is an engine Pi. Its list is just the admin keys (felix + mateo). Files exist, so the check passes for everyone.
2. Marjorie's key (only on alert_server / platform_react_server) is never checked at all.
3. If her .pub file is missing or the name has a typo, the role still crashes later on those hosts, in the lookup('file') step, with exactly the cryptic error this PR is meant to replace.

Fix: just delete the two run_once: true lines. Each host then checks its own list, a missing file fails early with the clear "Public key file not found" message, before anything is written. The cost is only a few extra local stat calls, negligible.

[MateoLostanlen]

Thanks for the edit !