refactor: move host configs under hosts/{jupiter,vps}

- git-mv jupiter/ vps/ into hosts/; fix ../ -> ../../ for common/services/secrets
- flake.nix + deploy point at hosts/<config>/
- README structure updated
- verified: jupiter/vps/vbox all eval

hosts/jupiter/secrets.nix

@@ -0,0 +1,28 @@
+{ config, ... }:
+
+# sops-nix secret wiring (real host only; not imported by vm.nix).
+# Encrypted values live in ../../secrets/jupiter.yaml, decrypted at activation to
+# /run/secrets/<name>.
+#
+# The host decrypts with its OWN SSH host key (age identity derived via
+# ssh-to-age, recipient listed in ../../.sops.yaml). The key is pre-generated on
+# the laptop and shipped once at install as /etc/ssh/ssh_host_ed25519_key
+# (nixos-anywhere --extra-files) — so decryption works on boot #1 and there is
+# no separate sops-only key to manage.
+{
+  sops.defaultSopsFile = ../../secrets/jupiter.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  # Decrypts to /run/secrets/samba_password (root-only by default).
+  sops.secrets.samba_password = { };
+
+  # darman's login password (a sha-512 hash, not plaintext — generate with
+  # `mkpasswd -m sha-512`, edit via ./edit_secrets). neededForUsers makes it
+  # available before user setup, at /run/secrets-for-users/darman_password.
+  sops.secrets.darman_password.neededForUsers = true;
+  users.users.darman.hashedPasswordFile =
+    config.sops.secrets.darman_password.path;
+
+  # Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
+  sops.secrets.tailscale_authkey = { };
+}