feat(portal): add service drawers and employee portal preview

www/integrations/nixos/portal-secrets.nix

@@ -0,0 +1,26 @@
+# INACTIVE TEMPLATE. Not imported by the development flake or any deployed host.
+# Requires an owner-reviewed sops-nix NixOS module import in the host flake.
+{ config, lib, ... }:
+let cfg = config.aia.portalSecrets;
+in {
+  options.aia.portalSecrets = {
+    enable = lib.mkEnableOption "owner-reviewed portal deployment secrets";
+    encryptedFile = lib.mkOption { type = lib.types.path; description = "SOPS-encrypted YAML only; never a plaintext file"; };
+    ageKeyFile = lib.mkOption { type = lib.types.str; description = "Private persisted host age key path outside the Nix store"; };
+    readerUser = lib.mkOption { type = lib.types.str; description = "Approved resource authorization service user"; };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [{ assertion = lib.hasPrefix "/" cfg.ageKeyFile && !(lib.hasPrefix "/nix/store/" cfg.ageKeyFile);
+      message = "The host age identity must be an absolute runtime path outside the Nix store."; }];
+    sops.defaultSopsFile = cfg.encryptedFile;
+    sops.age.keyFile = cfg.ageKeyFile;
+    sops.age.generateKey = false;
+    sops.age.sshKeyPaths = [];
+    sops.gnupg.sshKeyPaths = [];
+    sops.secrets."portal/staff-credentials" = { owner = cfg.readerUser; mode = "0400"; };
+    sops.secrets."portal/management-credentials" = { owner = cfg.readerUser; mode = "0400"; };
+    # Consumers reference config.sops.secrets.<name>.path at runtime.
+    # Do not use builtins.readFile on a decrypted secret, environment.etc.text,
+    # PUBLIC_* values, or Astro/Vite imports to transport secrets.
+  };
+}