Add sops-nix for secrets management

- Add flake.nix with sops-nix input
- Configure sops with age key encryption
- Add .sops.yaml template for age key configuration
- Create secrets/ directory for encrypted secrets
- Add .gitignore for age keys and nix result symlinks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

configuration.nix

@@ -39,6 +39,15 @@
   # === Sudo without password for wheel group ===
   security.sudo.wheelNeedsPassword = false;
 
+  # === SOPS (Secrets Management) ===
+  sops = {
+    defaultSopsFile = ./secrets/secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+    # Generate with: nix-shell -p age --run "age-keygen -o key.txt"
+    # Then add the public key to .sops.yaml
+  };
+
   # === Automatic Updates ===
   system.autoUpgrade = {
     enable = true;