feat(vps): enable Tailscale SSH

- Remove port 22 from firewall
- Add --ssh to tailscale up flags

hosts/vps/modules/services/openssh.nix

@@ -1,6 +1,7 @@
 {
   services.openssh = {
     enable = true;
+    openFirewall = false;
     settings = {
       PasswordAuthentication = false;
       PermitRootLogin = "prohibit-password";

hosts/vps/modules/services/tailscale.nix

@@ -8,5 +8,6 @@
     authKeyFile = config.sops.secrets."tailscale/authkey".path;
     useRoutingFeatures = "both";
     permitCertUid = "caddy";
+    extraUpFlags = [ "--ssh" ];
   };
 }