Fix SSH agent and systemd service race conditions

- bw-ssh-keys.service: use ssh-agent.service, add SSH_AUTH_SOCK env
- Stage 08: enable ssh-agent.socket, mask gcr-ssh-agent before services
- Stage 11: remove SSH agent section (moved to stage 08 for ordering)
- Stage 09: remove stale bw-load-ssh autostart config
- .zshrc: export SSH_AUTH_SOCK to match OpenSSH agent socket
- Remove config/autostart/ (no longer needed)
- porridge daemon: no longer exits on missing API key;
  add SIGHUP handler for live config reload

config/systemd/bw-ssh-keys.service

@@ -1,11 +1,14 @@
 [Unit]
 Description=Load Bitwarden SSH keys into ssh-agent
-After=graphical-session.target
-Wants=graphical-session.target
+# Use ssh-agent.service (OpenSSH) instead of GCR/gnome-keyring SSH agent
+# to avoid conflicts — keys are loaded into the socket the terminal sees.
+After=ssh-agent.service
+Wants=ssh-agent.service
 
 [Service]
 Type=oneshot
 Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+Environment=SSH_AUTH_SOCK=%t/ssh-agent.sock
 ExecStart=%h/.local/bin/bw-load-ssh.sh
 RemainAfterExit=yes
 Restart=on-failure