feat(secrets): decrypt the login password from sops (task 0010)

Wire sops-nix into the shared base config as unconditional plumbing, with
a two-tier age identity model: an admin identity held outside the repo, and
a per-host identity generated on the machine and kept on its encrypted root.
Both `sshKeyPaths` defaults are cleared so the SSH host keys stay out of the
decryption path and remain free to become secrets in their own right.

The primary user's password hash moves into a shared secrets file encrypted
to admin plus neogaia, consumed through `hashedPasswordFile` and decrypted
before accounts are created.

This needs `users.mutableUsers = false`: NixOS applies a declared hash to an
already-existing account only when that flag is false, so at the default the
hand-set password would have been kept and the change would have been inert.
Root consequently has no password and is locked; sudo from wheel is the way
in, and generation rollback remains the recovery path.

.claude/tasks/0010-sops-skeleton-and-password.md

@@ -24,12 +24,37 @@ The transition is safe on `neogaia`: if activation fails the rebuild fails and t
 
 ## Acceptance criteria
 
-- [ ] An admin age identity exists in the operator's password manager; its private half is committed nowhere, in no form
-- [ ] A host age identity exists on `neogaia`'s encrypted root and was generated on the machine
-- [ ] The sops configuration in the repo names the admin recipient and the `neogaia` recipient
-- [ ] A shared secrets file, encrypted to admin plus `neogaia`, holds the primary user's password hash
-- [ ] The secrets flake input is added, following the base nixpkgs
-- [ ] The shared base config carries the machinery unconditionally — identity file location and default secrets file — with no enable flag
-- [ ] The password secret is declared beside the user declaration, consumed through `hashedPasswordFile`, and marked as needed for user creation
-- [ ] `nix flake check` builds the `neogaia` toplevel; a mistyped secret name or missing secrets file fails it
-- [ ] Manual confirmation: `neogaia` activates, and console login succeeds against the decrypted password hash
+- [x] An admin age identity exists in the operator's password manager; its private half is committed nowhere, in no form
+- [x] A host age identity exists on `neogaia`'s encrypted root and was generated on the machine
+- [x] The sops configuration in the repo names the admin recipient and the `neogaia` recipient
+- [x] A shared secrets file, encrypted to admin plus `neogaia`, holds the primary user's password hash
+- [x] The secrets flake input is added, following the base nixpkgs
+- [x] The shared base config carries the machinery unconditionally — identity file location and default secrets file — with no enable flag
+- [x] The password secret is declared beside the user declaration, consumed through `hashedPasswordFile`, and marked as needed for user creation
+- [x] `nix flake check` builds the `neogaia` toplevel; a mistyped secret name or missing secrets file fails it
+- [x] Manual confirmation: `neogaia` activates, and console login succeeds against the decrypted password hash
+
+## Implementation Notes
+
+**`users.mutableUsers = false` was required and is not in the plan.**
+NixOS applies a declared password hash to an account that already exists in `/etc/shadow` only when `mutableUsers` is false — `update-users-groups.pl` guards both assignments on it.
+At the default of true, `alexion` already existed, so `hashedPasswordFile` would have been ignored and the hand-set password kept, silently.
+The final acceptance criterion would then have passed while proving nothing, because the login being tested would still have been the old one.
+
+Two consequences follow, neither sanctioned by the spec.
+`passwd` no longer works, so rotating the password means re-running `mkpasswd`, re-encrypting the shared file, and rebuilding.
+Root has no declared password and is therefore locked (`!`), which blocks direct root login and the systemd emergency shell's `sulogin` prompt; `sudo` from the wheel group is unaffected, and generation rollback or `init=/bin/sh` remains available for recovery.
+Leaving root locked was chosen over declaring a root password, on the grounds that the recovery paths that survive a locked root do not depend on `/etc/shadow` at all.
+This is worth folding back into the parent spec before the servers exist, where a locked root and no SSH key would be a harder corner.
+
+**The negative half of the build criterion was exercised, not assumed.**
+A mistyped secret name fails with `the key 'alexion-passwrd' cannot be found`; a missing secrets file fails with `Path 'secrets/absent.yaml' does not exist in Git repository`.
+Both were tested by temporary edits that were reverted.
+
+**Identity handling.**
+The admin identity was generated by the operator in a terminal outside this session, so no copy of its private half ever reached the agent or the repo.
+The host identity was generated on `neogaia` into `/var/lib/sops-nix/key.txt` (mode 0400, root) on the `@root` subvolume of the LUKS-encrypted `cryptroot`, and never transmitted.
+
+**Follow-up worth flagging for 0011.**
+`services.openssh.enable` is true on `neogaia` with no declared `authorizedKeys`, so SSH is not a fallback route in if a future decryption failure locks the console.
+The task that makes the SSH host keys secrets is the natural place to settle that.