ssh <name> now transparently brings up an OpenVPN tunnel via a generic ProxyCommand wrapper before connecting, and tears it down after, for any tunnel declared in modules.home.vpn-ssh.tunnels. Companion modules.home.ssh module makes ~/.ssh/config declarative (previously hand-maintained), owning the wildcard IdentityAgent block. Deliberately keeps secret material out of Nix: each tunnel's .ovpn config and auth-user-pass credentials file are expected at ~/.config/vpn-ssh/<name>/{config.ovpn,credentials}, provisioned out of band per machine, since pulling them through Nix would land VPN private keys and passwords in the world-readable /nix/store. Enabled on elysium and zephyr for a bistack tunnel (10.0.0.126). Also, while testing this against those two hosts: - Wired modules/home/prismlauncher.nix into the aggregator's imports -- the file existed on disk but was never imported, so modules.home.prismlauncher.enable (set on both hosts) referenced a nonexistent option and neither host could build. - Bumped the helix flake input: its pinned commit no longer exists on the upstream tangled.org repo (history was rewritten there since this flake.lock was last updated), which blocked every home-manager switch on this flake, not just these two hosts.