feat: sops-nix for samba password secret

- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.sops.yaml

@@ -0,0 +1,14 @@
+# sops-nix encryption rules.
+# Secrets under secrets/ are encrypted to the age recipient(s) below.
+# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
+# editing; /var/lib/sops-nix/key.txt on the host for decryption).
+#
+# Add the host's own age key here later (derived from its ssh host key) so the
+# machine can decrypt without shipping a separate key.
+keys:
+  - &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
+creation_rules:
+  - path_regex: secrets/.*\.yaml$
+    key_groups:
+      - age:
+          - *admin