jupiter: add isolated Hermes Agent instance

A separate instance from terra's, deliberately locked down harder given
jupiter's much bigger blast radius (irreplaceable immich photos on an
unredundant RAID0, gitea/CI tokens, the whole media stack): its own
dedicated "hermes" system user rather than darman (who is in jupiter's
root-equivalent docker group), container.enable = true for whole-process
containment rather than native/bare-metal, its own Telegram bot + explicit
allowlist, and no volume access to /mnt/data or this repo. stateDir/
workingDirectory live on the array (off the 29G eMMC) for future coding-task
state, guarded by RequiresMountsFor like the rest of jupiter's array-backed
services.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/jupiter/secrets.nix

@@ -64,4 +64,21 @@
   sops.secrets.sabnzbd_eweka_username.owner = "sabnzbd";
   sops.secrets.sabnzbd_eweka_password.owner = "sabnzbd";
 
+  # Hermes Agent (hosts/jupiter/hermes-agent.nix) — a separate, isolated
+  # instance from terra's, with its OWN Telegram bot token (sharing terra's
+  # would 409-conflict two long-pollers on one token). opencode_go_api_key
+  # is the same provider account as terra (hosts/terra/secrets.nix) — a
+  # stateless API key, fine to duplicate across hosts. No owner override:
+  # sops.templates renders via a root-run activation script, which the
+  # hermes module's own activation script (also root) then reads — unlike
+  # sabnzbd's preStart, this doesn't run as the service's own user.
+  sops.secrets.opencode_go_api_key = { };
+  sops.secrets.telegram_bot_token = { };
+  sops.templates."hermes-agent.env".content = ''
+    OPENCODE_GO_API_KEY=${config.sops.placeholder.opencode_go_api_key}
+    TELEGRAM_BOT_TOKEN=${config.sops.placeholder.telegram_bot_token}
+    TELEGRAM_HOME_CHANNEL=15151223
+    TELEGRAM_ALLOWED_USERS=15151223
+  '';
+
 }