feat: configure encrypted OpenCode credentials

[ajaxbits]

Summary

• add an agenix-encrypted OpenCode environment file for the Grace editor
• mount only that secret directory read-only into the guest
• configure the OpenCode systemd service to consume it

Validation

• complete patroclus NixOS configuration evaluation
• verified the encrypted secret decrypts using the patroclus SSH host identity, without printing its contents
• verified the guest service resolves the expected EnvironmentFile and read-only VirtioFS share

The service will use the stable credentials after this PR is deployed and microvm@grace-editor is restarted.

[ajaxbits]

Superseded by #158, rebased onto deployed #156 and fixing the secret-file materialization required for the guest VirtioFS share.