feat: add GPG key setup script and generalize nginx GPG key serving

Add script/setup/gpg.sh to generate a dedicated lair keyring with a
certify-only master key and a 1-year signing subkey, cross-signed by
both personal keys. The public key is synced to oolon as <short-id>.gpg.

Update nginx config to serve any .gpg file instead of a hardcoded
RPM-GPG-KEY-mistralrs path, supporting multiple keys as the repo grows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

asset/nginx/rpm.lair.cafe.conf

@@ -30,7 +30,7 @@ server {
         add_header Cache-Control "no-cache, must-revalidate";
     }
 
-    location = /RPM-GPG-KEY-mistralrs {
+    location ~ \.gpg$ {
         default_type text/plain;
     }
 }