Add sops-nix for secrets management

- Add flake.nix with sops-nix input
- Configure sops with age key encryption
- Add .sops.yaml template for age key configuration
- Create secrets/ directory for encrypted secrets
- Add .gitignore for age keys and nix result symlinks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.sops.yaml

@@ -0,0 +1,10 @@
+keys:
+  # Replace with your age public key (from age-keygen)
+  # Example: age1qyqszq...
+  - &vps age1__REPLACE_WITH_YOUR_AGE_PUBLIC_KEY__
+
+creation_rules:
+  - path_regex: secrets/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *vps