A spawned child has its own secret key, SSH host key and subdomain, and a test proves it cannot read the parent's

Part of spawning (#389). Comes after the child's first boot.

Acceptance:

[ ] the child generates its own secret.key and SSH host key in its own data dir. Neither is derived from or copied from the parent's (a test compares them)
[ ] a test proves no file under the parent's data dir is readable through the child's config or env
[ ] the child's domain defaults to <name>.<parent's domain>, recorded in its config and shown on its home page
[ ] where the child tells people how to connect, it prints FORGE_APP_SSH verbatim. When that is unset, it says the terminal is off

Files: src/spawn/*, src/core/keys.ts, src/core/domains.ts, test/spawn-keys.test.ts. Fits: mason.

A spawned child has its own secret key, SSH host key and subdomain, and a test proves it cannot read the parent's #576