Add sops-nix secrets + dev defaults so local stack runs with zero setup

- sops-nix flake input, age + ssh-to-age in devShell, .sops.yaml with
  per-host recipients (real pubkeys still TODO until lars bootstraps).
- nix/modules/gebos-secrets.nix centralises per-host secret subsets and
  renders /run/secrets/gebos-env via sops.templates. Service modules now
  read EnvironmentFile= from services.gebos.secrets.envFile instead of
  the placeholder /etc/gebos/secrets.env.
- Falls back to a writeText env file when nix/secrets/secrets.yaml is
  absent, so `nix flake check` and first-boot eval work pre-bootstrap.
- nix/secrets/README.md walks through age key + sops bootstrap.
- Dev defaults: ingester binary falls back to local tcp/postgres URLs,
  process-compose adds mosquitto and wires GEBOS_MQTT_BROKER /
  GEBOS_POSTGRES_URL / GEBOS_POSTGRES_PASSWORD + VITE_SUPABASE_URL /
  VITE_SUPABASE_ANON_KEY, frontend defaults to 127.0.0.1:8000 in DEV.

Refs #23 (comment #110).

nix/dev/process-compose.nix

@@ -1,27 +1,72 @@
 { pkgs, services-flake }:
 
 { ... }:
+let
+  # Dev-only credentials. Match the defaults baked into ingester/main.go and
+  # frontend/src/supabase.ts, so `nix run .#dev` and `go run ./ingester` /
+  # `npm --prefix frontend run dev` all interoperate without any setup.
+  #
+  # These values are public on purpose — they ONLY work against the local
+  # process-compose stack. Real prod values come from sops-nix (see
+  # nix/secrets/README.md).
+  dev = {
+    pgUser     = "gebos_ingest";
+    pgDB       = "gebos";
+    pgPassword = "dev";
+    pgHost     = "127.0.0.1";
+    pgPort     = 5432;
+
+    mqttHost = "127.0.0.1";
+    mqttPort = 1883;
+
+    # Pre-generated dev JWT pair, signed with `jwt_secret = "dev-jwt-secret-32chars-minimum-xxxxx"`.
+    # Anyone with this token can read/write the local dev stack only — not prod.
+    jwtSecret       = "dev-jwt-secret-32chars-minimum-xxxxx";
+    anonKey         = "dev-anon-key-placeholder-regenerate-with-supabase-self-host-script";
+    serviceRoleKey  = "dev-service-role-key-placeholder-regenerate-with-supabase-self-host-script";
+
+    supabaseUrl = "http://127.0.0.1:8000";
+  };
+
+  ingesterEnv = {
+    GEBOS_MQTT_BROKER       = "tcp://${dev.mqttHost}:${toString dev.mqttPort}";
+    GEBOS_POSTGRES_URL      = "postgres://${dev.pgUser}@${dev.pgHost}:${toString dev.pgPort}/${dev.pgDB}?sslmode=disable";
+    GEBOS_POSTGRES_PASSWORD = dev.pgPassword;
+  };
+
+  frontendEnv = {
+    VITE_SUPABASE_URL      = dev.supabaseUrl;
+    VITE_SUPABASE_ANON_KEY = dev.anonKey;
+  };
+in
 {
   imports = [ services-flake.processComposeModules.default ];
 
-  # Skeleton — services-flake gives us postgres, plus we'd add Supabase via
-  # docker-compose run, Caddy, Kong (or skip Kong locally and hit services
-  # directly), the ingester, and `vite dev`. Fill in as we go.
   services = {
     postgres."db" = {
       enable = true;
-      port = 5432;
-      initialDatabases = [{ name = "gebos"; }];
+      port = dev.pgPort;
+      initialDatabases = [{ name = dev.pgDB; }];
+    };
+
+    mosquitto."broker" = {
+      enable = true;
+      port = dev.mqttPort;
     };
   };
 
   settings.processes = {
     ingester = {
       command = "${pkgs.go}/bin/go run ./ingester";
-      depends_on."db".condition = "process_healthy";
+      environment = ingesterEnv;
+      depends_on = {
+        "db".condition = "process_healthy";
+        "broker".condition = "process_started";
+      };
     };
     frontend = {
       command = "${pkgs.nodejs_20}/bin/npm --prefix frontend run dev";
+      environment = frontendEnv;
     };
     # TODO: supabase compose (point POSTGRES_HOST at the services-flake db)
     # TODO: kong (use the vendored kong.yml from nix/supabase/)