Save generated SSH key locally to ~/.ssh/bb-<device_id>

Infisical is the backup copy. Local key at a predictable path means
no hunting — ssh -i ~/.ssh/bb-<device_id> just works.

operator_setup.sh

@@ -532,6 +532,15 @@ if [[ "$SSH_MODE" == "generate" ]]; then
         echo "$PRIVKEY"
         echo "---"
     fi
+
+    # Save locally to ~/.ssh/bb-<device_id>
+    LOCAL_KEY_DIR="$HOME/.ssh"
+    LOCAL_KEY_PATH="${LOCAL_KEY_DIR}/bb-${DEVICE_ID}"
+    mkdir -p "$LOCAL_KEY_DIR"
+    echo "$PRIVKEY" > "$LOCAL_KEY_PATH"
+    chmod 600 "$LOCAL_KEY_PATH"
+    info "Private key saved locally: ${LOCAL_KEY_PATH}"
+
     unset PRIVKEY
 else
     echo "$SSH_PUBKEY" > "${SSH_DIR}/authorized_keys"
@@ -785,12 +794,7 @@ echo ""
 echo -e "${CYAN}To SSH after first-boot:${NC}"
 
 if [[ "$SSH_MODE" == "generate" ]]; then
-    INFISICAL_KEY="SSH_PRIVKEY_$(echo "$DEVICE_ID" | tr '[:lower:]-' '[:upper:]_')"
+    echo "  ssh -i ~/.ssh/bb-${DEVICE_ID} root@<DEVICE_IP>"
-    if [[ -x "$CREDS" ]]; then
-        echo "  ${CREDS} get ${INFISICAL_KEY} > /tmp/${DEVICE_ID}.key"
-        echo "  chmod 600 /tmp/${DEVICE_ID}.key"
-        echo "  ssh -i /tmp/${DEVICE_ID}.key root@<DEVICE_IP>"
-    fi
 else
     echo "  ssh -i $(dirname $ssh_pubkey_path)/$(basename $ssh_pubkey_path .pub) root@<DEVICE_IP>"
 fi