feat: sops-nix secrets management

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

secrets/README.md

@@ -0,0 +1,37 @@
+# omni secrets (sops-nix)
+
+Encrypted YAML files in this directory are decrypted at NixOS
+activation time and exposed under `/run/secrets/<name>` for the
+services that declare `sops.secrets.<name>` to consume.
+
+Recipients are declared in `../.sops.yaml`. On omni/bohm the
+matching private key lives at `~/.config/sops/age/keys.txt`.
+
+## Workflow
+
+```bash
+# First-time: create + encrypt the omni default file
+sops secrets/omni.yaml
+# adds the sops: metadata block and encrypts in place
+
+# Later edits go through sops (auto-decrypts, re-encrypts on save)
+sops secrets/omni.yaml
+```
+
+## First migration targets
+
+See `../modules/mcp.nix` for the current plaintext-file references
+that should move under sops:
+
+- `forgejo-token` — Forgejo personal access token (forgejo-mcp)
+- `lnbits-admin-key` — LNbits admin API key (lnbits-mcp)
+
+Once `secrets/omni.yaml` exists and is encrypted, declare each in
+the consuming module:
+
+```nix
+sops.secrets.forgejo-token = { mode = "0400"; owner = config.omni.user; };
+```
+
+and switch the path reference (e.g. `forgejoTokenFile`) to
+`config.sops.secrets.forgejo-token.path`.