feat: sops-nix for samba password secret

- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/configuration.nix

@@ -5,6 +5,7 @@
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix          # disko: OS-disk partitions + filesystems
+    ./secrets.nix              # sops-nix: samba password etc.
     ./services.nix
   ];