Add git-crypt support and update Sops configuration for multiple hosts

- Introduced a new secrets file for git-crypt personal documents.
- Updated .sops.yaml to include new key groups for host-specific secrets.
- Configured Sops settings in client-services.nix for managing secrets.
- Removed redundant Sops configurations from multiple host configurations (14900k, ideapad, t2mbp, uConsole) to streamline secret management.
- Added git-crypt to desktop-home-base package list.

modules/hosts/ideapad/configuration.nix

@@ -37,26 +37,6 @@
         ./_private/platform.nix
       ];
 
-      # ─────────────────────── Sops ───────────────────────
-      # `host_ideapad` recipient in `.sops.yaml` derives from the new ed25519 host key (post-reflash).
-      sops = {
-        defaultSopsFile = ../../../secrets/secrets.yaml;
-        defaultSopsFormat = "yaml";
-        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      };
-
-      sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
-      sops.secrets."caching/attic/token" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-      sops.secrets."swiftshare/API_KEY" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-
       # ─────────────────────── Mobile NixOS / firmware ───────────────────────
       # mruby's test-suite breaks on aarch64 in the Nix sandbox; the overlay strips checks and
       # rebuilds Mobile NixOS' script-loader against the patched mruby.