Refactor llm config

modules/home/secrets.nix

@@ -1,5 +1,11 @@
-{ inputs, config, ... }:
+{ inputs, config, lib, ... }:
 
+let
+  # Both pi and opencode talk to Langdock on work machines and expect the API
+  # key in the environment, so the secret is managed here rather than in the
+  # individual agent modules.
+  needsLangdock = config.dot.llm.pi.workMode || config.dot.llm.opencode.workMode;
+in
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
@@ -12,9 +18,24 @@
     age = {
       keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
     };
+
+    secrets = lib.mkIf needsLangdock {
+      langdock_api_key = {
+        # Uses defaultSopsFile from secrets.nix
+      };
+    };
   };
 
   home.sessionVariables = {
     SOPS_AGE_KEY_FILE = config.sops.age.keyFile;
   };
+
+  # Export the decrypted langdock API key as an env var. The secret lives in a
+  # runtime file, so it is read at shell startup rather than baked into the Nix
+  # store via home.sessionVariables.
+  programs.zsh.initContent = lib.mkIf needsLangdock ''
+    if [ -r "${config.sops.secrets.langdock_api_key.path}" ]; then
+      export LANGDOCK_API_KEY="$(cat "${config.sops.secrets.langdock_api_key.path}")"
+    fi
+  '';
 }