fix(sshd): make authorized_keys fallback readable by the session user

The fallback was created via cp as root:root 0600 and relied on a separate
chown task to fix ownership. When that chown did not take, sshd could not
read /etc/ssh/authorized_keys/<user> in the unprivileged session, so pubkey
auth failed whenever the encrypted home was locked.

Replace the cp + chown pair with a single idempotent copy that keeps the
file root-owned but world-readable (0644). It contains only public keys, so
0644 is safe and passes StrictModes.

roles/sshd/tasks/main.yml

@@ -51,16 +51,13 @@
         mode: "0755"
 
     - name: Backup authorized_keys out of HOME dir (if unavailable at startup)
-      ansible.builtin.command: "cp /home/{{ item }}/.ssh/authorized_keys {{ ssh_authorized_keys_fallback_dir }}/{{ item }}"
+      ansible.builtin.copy:
-      loop: "{{ ssh_users.split() }}"
+        src: "/home/{{ item }}/.ssh/authorized_keys"
-      changed_when: false
+        dest: "{{ ssh_authorized_keys_fallback_dir }}/{{ item }}"
-
+        remote_src: true
-    - name: Fix ownership
+        owner: root
-      ansible.builtin.file:
+        group: root
-        path: "{{ ssh_authorized_keys_fallback_dir }}/{{ item }}"
+        mode: "0644"
-        owner: "{{ item }}"
-        group: "{{ item }}"
-        mode: "0600"
       loop: "{{ ssh_users.split() }}"
 
 - name: Remove motd on Debian