Migrate live secrets to sops-nix (Milestone 2)

Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.

Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
  derived (via ssh-to-age) from each live host's existing SSH host
  key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
  hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
  nix.conf to a sops.templates-rendered file included via nix.conf's
  native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
  `environmentFile` (runtime-only via sops.templates); the dead
  commented-out docker token is removed from the tree entirely.

Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.

Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.

Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/nix-cache/host.nix

@@ -1,14 +1,19 @@
-{ ... }:
+{ config, ... }:
 
 {
   networking.hostName = "nix-cache";
 
+  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
+  sops.templates."nix-cache-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
     #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    TOKEN = "c9192e4c-7b5d-4910-8241-c2d68afadbac";
   };
+  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;
 
   # Preserved from the pre-refactor `nix-cache` target — stateVersion must
   # never be bumped on an already-installed machine.

hosts/server/host.nix

@@ -1,17 +1,22 @@
-{ ... }:
+{ config, ... }:
 
 {
   networking.hostName = "server";
   networking.hostId = "6689f93e";
 
+  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
+  sops.templates."server-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
     #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    TOKEN = "48e71783-35df-4ea0-a8c2-05bc5e020d2e";
     EXTRA_FILESYSTEMS = "/tank/docker/volumes";
     LOG_LEVEL = "debug";
   };
+  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;
 
   # Preserved from the pre-refactor `server` target — stateVersion must never
   # be bumped on an already-installed machine.