feat: initial import of RailianceHosts starter

keys/README.md

@@ -0,0 +1,7 @@
+# Keys
+
+- `age.pub` — your **public** age key (safe to commit).
+- Your **private** age key is **NOT** stored here. Keep it in your password manager and load it locally as needed, e.g.:
+  ```bash
+  export SOPS_AGE_KEY=$(pass show age/railliance-hosts)   # example
+  ```