feat: darman login password via sops (hashedPasswordFile)

- add darman_password (sha-512 hash) to secrets/jupiter.yaml
- neededForUsers so it lands in /run/secrets-for-users before user setup
- real host uses hashedPasswordFile; VM keeps its test initialPassword

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/secrets.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 # sops-nix secret wiring (real host only; not imported by vm.nix).
 # Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
@@ -15,4 +15,11 @@
 
   # Decrypts to /run/secrets/samba_password (root-only by default).
   sops.secrets.samba_password = { };
+
+  # darman's login password (a sha-512 hash, not plaintext — generate with
+  # `mkpasswd -m sha-512`, edit via ./edit_secrets). neededForUsers makes it
+  # available before user setup, at /run/secrets-for-users/darman_password.
+  sops.secrets.darman_password.neededForUsers = true;
+  users.users.darman.hashedPasswordFile =
+    config.sops.secrets.darman_password.path;
 }