systemd loads EnvironmentFile before ExecStartPre runs, so the env file
could never exist in time. Replace with a single ExecStart wrapper script
that reads sops secrets directly and execs jirorian.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the jirorian NixOS module (systemd service, sops secrets, Caddy
fragment), wires it into the flake as a Codeberg input, fixes the Caddy
glob import path, and encrypts all five R2/Nostr secrets into bucur.yaml.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>