feat(sops): add sops-nix input, core module and devShell tooling

Wires sops-nix into every machine via machines/core/sops.nix so hosts
decrypt with their existing SSH host key. Adds a devShell exposing
sops/age/ssh-to-age for the operator workflow, which also fixes .envrc's
previously no-op `use flake`.

flake.nix

@@ -11,6 +11,10 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
   };
 
@@ -36,6 +40,15 @@
           _module.args.pkgs = import inputs.nixpkgs {
             inherit system;
           };
+
+          devShells.default = pkgs.mkShell {
+            packages = with pkgs; [
+              sops
+              age
+              ssh-to-age
+              nixfmt
+            ];
+          };
         };
 
       systems = [ "x86_64-linux" ];