docs: sops-nix secrets workflow

Operator runbook for adding a secret, adding a new host, and rotating
keys, plus a pointer from CLAUDE.md's architecture overview.

CLAUDE.md

@@ -35,6 +35,7 @@ flake.nix
     │   ├── core.nix                   # system packages, locale, timezone
     │   ├── network.nix
     │   ├── nix.nix
+    │   ├── sops.nix                   # sops-nix decryption config, sops/age/ssh-to-age on PATH
     │   └── users.nix
     ├── modules/                       # custom NixOS option modules (my.profiles.*, my.hardware.*, my.services.*)
     │   ├── environments/              # per-service/app profiles
@@ -43,10 +44,21 @@ flake.nix
     └── machines/<name>/
         ├── configuration.nix          # machine-specific NixOS settings
         ├── environments.nix           # enables profiles via my.profiles.* / my.hardware.* options
+        ├── secrets.nix                # sops.secrets declared for this host
         ├── disks.nix
         └── hardware-configuration.nix
 ```
 
+### Secrets (sops-nix)
+
+Secrets are encrypted with sops, decrypted per-host from that host's SSH host
+key. `.sops.yaml` defines who can decrypt what; `secrets/<host>.yaml` holds
+the encrypted values; `machines/<host>/secrets.nix` declares which secrets
+that host exposes and consumes them via `config.sops.secrets.<name>.path`.
+Always `git add` a secrets file before `nix build` — untracked files are
+invisible to flake evaluation. Full workflow (adding a secret, adding a host,
+rotating keys): see [`docs/secrets.md`](docs/secrets.md).
+
 ### Profile / Module Pattern
 
 Every module under `modules/` follows the same structure: