Fix SSH agent and systemd service race conditions

- bw-ssh-keys.service: use ssh-agent.service, add SSH_AUTH_SOCK env
- Stage 08: enable ssh-agent.socket, mask gcr-ssh-agent before services
- Stage 11: remove SSH agent section (moved to stage 08 for ordering)
- Stage 09: remove stale bw-load-ssh autostart config
- .zshrc: export SSH_AUTH_SOCK to match OpenSSH agent socket
- Remove config/autostart/ (no longer needed)
- porridge daemon: no longer exits on missing API key;
  add SIGHUP handler for live config reload

stages/09-desktop.sh

@@ -168,7 +168,7 @@ autostart_app() {
   fi
 }
 
-# Apps to autostart at login
+# Apps to autostart at login (from system .desktop files)
 autostart_app "firefox" "org.mozilla.firefox.desktop"
 autostart_app "ghostty" "com.mitchellh.ghostty.desktop"
 autostart_app "nextcloud" "com.nextcloud.desktopclient.nextcloud.desktop"