`omarchy setup security sshd` prints "Setting up SSH server access with key-based authentication", and then starts sshd with the distribution defaults — which accept passwords.

## Password authentication is never turned off

Nothing in the repo writes to `sshd_config`:

```
$ grep -rn "PasswordAuthentication\|PermitRootLogin\|sshd_config" bin install migrations default etc
$
```

OpenSSH's own compiled-in default is `PasswordAuthentication yes`. Arch ships `/etc/ssh/sshd_config.d/99-archlinux.conf`, and it does not change that — it only sets:

```
KbdInteractiveAuthentication no
UsePAM yes
PrintMotd no
```

So after the command finishes, the machine accepts SSH password logins for every local account, from whatever network it is attached to. `ufw limit 22/tcp` rate-limits a single source IP; it does not stop a distributed attempt, and it does nothing about a weak or reused login password — which on a personal desktop is common, and which Omarchy also lets you retry ten times at the sudo prompt (`etc/sudoers.d/omarchy-passwd-tries`).

A command whose entire purpose is to authorize a public key should not leave password authentication reachable.

## The port opens before the key exists

```bash
setup_sshd        # omarchy-pkg-add openssh; systemctl enable --now sshd.service
open_firewall     # ufw limit 22/tcp

echo
if [[ -n $KEY ]]; then
  authorize_key "$KEY" || exit 1
  ...
```

The server is enabled and the firewall opened *first*. Every way the key step can fail happens after that:

- `gum choose` / `gum input` cancelled — `|| exit 1`
- a pasted key that `ssh-keygen -lf` rejects — `authorize_key ... || exit 1`
- `--gh-keys` for a user with no public keys — `exit 1`

Each leaves a listening, network-reachable sshd with password authentication on and **no authorized key at all**, and says nothing about it. The `set -e` at the top means an unexpected failure anywhere in between does the same.

## Reproduce

```
$ omarchy setup security sshd
  (choose "Paste key manually", then press Esc)

$ systemctl is-enabled sshd
enabled
$ sudo sshd -T | grep -i passwordauthentication
passwordauthentication yes
$ ls ~/.ssh/authorized_keys
ls: cannot access '/home/you/.ssh/authorized_keys': No such file or directory
```

## Expected

Password (and keyboard-interactive) authentication off, and nothing listening or opened until a key has actually been authorized.

Related but separate: #8248 asks about which interfaces sshd binds to. This one is about how it authenticates and when it starts.