refactor: move host configs under hosts/{jupiter,vps}

- git-mv jupiter/ vps/ into hosts/; fix ../ -> ../../ for common/services/secrets
- flake.nix + deploy point at hosts/<config>/
- README structure updated
- verified: jupiter/vps/vbox all eval

hosts/vps/secrets.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+
+# sops-nix wiring for the VPS. Encrypted values live in ../../secrets/vps.yaml,
+# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
+# The host key is pre-generated on the laptop and shipped at install
+# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
+{
+  sops.defaultSopsFile = ../../secrets/vps.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets.tailscale_authkey = { };
+}