Add sops-nix secrets integration and installer ISO configuration with docs

[moons-14]

Motivation

• Provide first-class support for host-specific encrypted secrets via sops-nix and document an SSH-first installer ISO workflow.
• Make it possible to build a minimal installer ISO that can generate host age keys and bootstrap secrets during installation.

Description

• Add sops-nix as a flake input and whitelist secrets/ and /.sops.yaml in .gitignore, and add a sample /.sops.yaml for age recipients.
• Introduce a new installer host and helpers by refactoring host builders with mkNixos, adding mkInstallerIso, and adding hosts/installer-iso/default.nix to provide an SSH-first installer image with required tooling and packages.
• Add security and secrets modules under modules/features/security and modules/system/secrets that wire sops-nix into the configuration and expose options such as ageKeyFile, generateKey, defaultSopsFile, and a userPassword flow that maps a SOPS secret to the primary user's hashedPasswordFile.
• Replace the SSH default-key activation script with a systemd user service in modules/features/identity/ssh-default-key.nix and make small user and profile config fixes (users.mutableUsers default, profiles/workloads/secure-storage.nix layout).
• Add documentation: installer guide at docs/installer/iso.md, installer recommendations at docs/installer/recommendations.md, and SOPS guidance at docs/secrets/sops-nix.md plus a secrets/users/README.md example.

Testing

• No automated tests were run as part of this change.

---

Codex Task