feat: sops-nix secrets management

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/secrets.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+# sops-nix per-host wiring.
+#
+# The sops-nix module itself is injected by lib/mksystem.nix. This
+# file points sops at the omni default file and the host's age
+# key. Secrets are exposed to services as files under
+# /run/secrets/<name>, declared per-secret via `sops.secrets.<name>`
+# in the module that consumes them.
+#
+# Recipients live in /etc/nixos/.sops.yaml; the matching age key
+# lives at ~/.config/sops/age/keys.txt on omni/bohm.
+
+let
+  sopsFile = ../secrets/omni.yaml;
+in
+{
+  sops = lib.mkIf (builtins.pathExists sopsFile) {
+    defaultSopsFile = sopsFile;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/home/padreug/.config/sops/age/keys.txt";
+  };
+}