Add optional secure boot module and docs

modules/system/secure-boot.nix

@@ -0,0 +1,23 @@
+{ lib, ... }:
+
+{
+  # Requires: import `inputs.lanzaboote.nixosModules.lanzaboote` alongside this module.
+  # Purpose: post-install Secure Boot enablement with self-managed keys.
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi = {
+    canTouchEfiVariables = true;
+    efiSysMountPoint = "/boot";
+  };
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/secureboot"; # persistent location (not in the Nix store)
+    autoGenerateKeys.enable = true;
+    autoEnrollKeys = {
+      enable = true;
+      includeMicrosoftKeys = true; # keeps Windows/option-ROM compatibility
+      autoReboot = false;
+    };
+  };
+}