feat: sops-nix for samba password secret

- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/secrets.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+# sops-nix secret wiring (real host only; not imported by vm.nix).
+# Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
+# /run/secrets/<name>. The host needs the age PRIVATE key at the keyFile path.
+#
+# Deploy the private key with the install, e.g. nixos-anywhere:
+#   --extra-files, placing your key at /var/lib/sops-nix/key.txt
+# or later derive a host age key from its ssh host key and add it to .sops.yaml.
+{
+  sops.defaultSopsFile = ../secrets/jupiter.yaml;
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+
+  # Decrypts to /run/secrets/samba_password (root-only by default).
+  sops.secrets.samba_password = { };
+}