feat(mibook): decrypt placeholder secret via host age key

Proves the sops-nix pipeline end to end on mibook: encrypts a
throwaway secret to the operator + mibook host keys, declares it in
machines/mibook/secrets.nix, and verifies it decrypts to
/run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch.

Also removes the dead `let secrets = config.sops.secrets;` binding
from both environments.nix files — leftover from an earlier abandoned
plan, never referenced.

machines/mibook/secrets.nix

@@ -0,0 +1,12 @@
+# Secrets decrypted on mibook. sopsFile defaults to secrets/mibook.yaml
+# via machines/core/sops.nix.
+{ ... }:
+{
+  # Pipeline smoke test — proves host-key decryption works end to end.
+  # Safe to delete once a real secret is in place.
+  sops.secrets.placeholder = {
+    mode = "0400";
+    owner = "root";
+    group = "root";
+  };
+}