feat: sops-nix for samba password secret

- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/vm.nix

@@ -18,14 +18,11 @@
   users.users.root.initialPassword = "test";
 
   # Throwaway SMB password for testing (samba-smbd login = darman / test).
-  # Two lines: smbpasswd wants the new password + confirmation.
+  # Single line — the provisioning oneshot feeds it twice for smbpasswd.
   # Real host must NOT do this — plaintext lands in the world-readable Nix
-  # store. Use sops-nix/agenix to place /etc/samba/smb-password instead.
+  # store. It uses sops-nix (secrets.nix) instead.
   environment.etc."samba/smb-password" = {
-    text = ''
-      test
-      test
-    '';
+    text = "test\n";
     mode = "0600";
   };