feat(mibook): decrypt placeholder secret via host age key

Proves the sops-nix pipeline end to end on mibook: encrypts a
throwaway secret to the operator + mibook host keys, declares it in
machines/mibook/secrets.nix, and verifies it decrypts to
/run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch.

Also removes the dead `let secrets = config.sops.secrets;` binding
from both environments.nix files — leftover from an earlier abandoned
plan, never referenced.

machines/jupiter/environments.nix

@@ -1,9 +1,5 @@
 # enabled profiles
-{ config, lib, ... }:
-let
-  secrets = config.sops.secrets;
-in
-{
+_: {
   my.profiles = {
     hyprland.enable = false;
     zsh.enable = true;

machines/mibook/configuration.nix

@@ -11,6 +11,7 @@
     ./hardware-configuration.nix
     ./environments.nix
     ./network.nix
+    ./secrets.nix
     # ./system.nix use docker here
   ];
 
@@ -21,7 +22,6 @@
     useOSProber = true;
   };
 
-
   # Configure keymap in X11
   services.xserver.xkb = {
     layout = "de";
@@ -35,7 +35,6 @@
   services.printing.enable = true;
   nixpkgs.config.allowUnfree = true;
 
-
   hardware.nvidia.prime = {
     sync.enable = false;
 

machines/mibook/environments.nix

@@ -1,9 +1,5 @@
 # enabled profiles
-{ config, lib, ... }:
-let
-  secrets = config.sops.secrets;
-in
-{
+_: {
   my.profiles = {
     kde-desktop.enable = true;
     zsh.enable = true;

machines/mibook/secrets.nix

@@ -0,0 +1,12 @@
+# Secrets decrypted on mibook. sopsFile defaults to secrets/mibook.yaml
+# via machines/core/sops.nix.
+{ ... }:
+{
+  # Pipeline smoke test — proves host-key decryption works end to end.
+  # Safe to delete once a real secret is in place.
+  sops.secrets.placeholder = {
+    mode = "0400";
+    owner = "root";
+    group = "root";
+  };
+}