feat: sops-nix secrets management

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.sops.yaml.example

@@ -0,0 +1,13 @@
+keys:
+  # Your age PUBLIC key. Generate a keypair with:
+  #   age-keygen -o ~/.config/sops/age/keys.txt
+  # then paste the "Public key:" line below (starts with "age1...").
+  # Copy this file to .sops.yaml and fill it in.
+  # pragma: allowlist secret
+  - &admin age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY
+
+creation_rules:
+  - path_regex: secrets/.*\.yaml$
+    key_groups:
+      - age:
+          - *admin