Delete the instance signing key

Delete the instance signing key

The key existed to sign run records, and runner signing made it pointless — but
deleting it is not tidying. An instance-signed anything can only be checked by
trusting the instance, so a mirror or a third party cannot verify it: trust would sit
on the box. With users, runners and approvers each holding a key, trust sits on the
parties, and the server is a relay that can withhold service but cannot forge a
result. That is a property worth having, and the key was the one thing contradicting
it.

So: `internal/signing` is gone, `Config.InstanceKey()` is gone, the server no longer
loads a key at boot, and `/healthz` reports only the user count instead of a
fingerprint nothing verifies. The host key is now the only secret the instance holds,
which is what the backup section of the README says.

`go mod tidy` changes nothing: the package only used the standard library.

Verified: scripts/ci.sh green (gofmt, vet, build, markdown links, go test -race ./...,
including TestHealthzReportsUsers against the new body and the full end-to-end suite
that starts the server from a fresh data directory).