Add sops-nix secrets + dev defaults so local stack runs with zero setup

- sops-nix flake input, age + ssh-to-age in devShell, .sops.yaml with
  per-host recipients (real pubkeys still TODO until lars bootstraps).
- nix/modules/gebos-secrets.nix centralises per-host secret subsets and
  renders /run/secrets/gebos-env via sops.templates. Service modules now
  read EnvironmentFile= from services.gebos.secrets.envFile instead of
  the placeholder /etc/gebos/secrets.env.
- Falls back to a writeText env file when nix/secrets/secrets.yaml is
  absent, so `nix flake check` and first-boot eval work pre-bootstrap.
- nix/secrets/README.md walks through age key + sops bootstrap.
- Dev defaults: ingester binary falls back to local tcp/postgres URLs,
  process-compose adds mosquitto and wires GEBOS_MQTT_BROKER /
  GEBOS_POSTGRES_URL / GEBOS_POSTGRES_PASSWORD + VITE_SUPABASE_URL /
  VITE_SUPABASE_ANON_KEY, frontend defaults to 127.0.0.1:8000 in DEV.

Refs #23 (comment #110).

README.md

@@ -55,6 +55,12 @@ nix run github:serokell/deploy-rs -- .                # all hosts
 
 ## Secrets
 
-Out-of-band file at `/etc/gebos/secrets.env` on each host, mode `0400`, loaded
-by systemd `EnvironmentFile=`. Not in the repo, not in the Nix store. Rotation
-is manual (ssh + edit + restart unit).
+[sops-nix](https://github.com/Mic92/sops-nix) + [age](https://github.com/FiloSottile/age).
+Single encrypted file at `nix/secrets/secrets.yaml`; each host decrypts only the
+keys it needs at activation, rendered into a tmpfs env file consumed by systemd
+`EnvironmentFile=`. Plaintext never enters the Nix store. See
+[`nix/secrets/README.md`](nix/secrets/README.md) for bootstrap and rotation.
+
+Local dev needs **no** secrets bootstrap — `nix run .#dev`, `go run ./ingester`,
+and `npm --prefix frontend run dev` all default to the local dev stack values
+defined in `nix/dev/process-compose.nix`.