Add optional secure boot module and docs

docs/secure-boot.md

@@ -0,0 +1,19 @@
+# Secure Boot after installing
+
+The installer ISO still requires Secure Boot *off* to boot. After installation you can enable Secure Boot on the installed system using Lanzaboote.
+
+Steps (per host):
+
+1) In `flake.nix` inputs, keep `lanzaboote.url = "github:nix-community/lanzaboote";` (already present).
+2) In your host module (e.g. `hosts/<hostname>.nix`), add imports:
+   - `inputs.lanzaboote.nixosModules.lanzaboote`
+   - `../modules/system/secure-boot.nix`
+3) Rebuild on the target system (with Secure Boot still disabled):  
+   `sudo nixos-rebuild switch --flake .#<hostname>`
+4) Reboot once more to let Lanzaboote enroll keys; you’ll see a brief enrollment phase via systemd-boot.
+5) Enter firmware setup and re-enable Secure Boot. Boot should now succeed with the signed UKI.
+
+Notes
+- Keys are stored at `/var/lib/secureboot` (persist this if you use impermanence).
+- Microsoft keys are included for compatibility; adjust in `secure-boot.nix` if you want fully custom trust.
+- If you regenerate keys, re-run the rebuild and reboot before toggling firmware settings.