1c/W2a: mount cc-ci-secrets as submodule at secrets/; cert+key now sops-decrypted to /var/lib/ci-certs/live

- secrets/ is now the private cc-ci-secrets repo (submodule). defaultSopsFile path unchanged.
- secrets.nix: add wildcard_cert/wildcard_key sops secrets -> path=/var/lib/ci-certs/live/*.
- proxy.nix: cert is sops-from-git, not an operator file drop (reframed; FATAL guard kept as decrypt-path check).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/proxy.nix

@@ -1,6 +1,8 @@
 # Reverse proxy = the canonical Co-op Cloud `traefik` recipe, deployed via abra in
-# wildcard / file-provider mode (operator's pre-issued cert as ssl_cert/ssl_key swarm secrets,
+# wildcard / file-provider mode (wildcard cert as ssl_cert/ssl_key swarm secrets,
 # LETS_ENCRYPT_ENV empty => NO ACME, no DNS token). See DECISIONS.md "Proxy: real coop-cloud/traefik".
+# Phase-1c: the cert at CERT_DIR is sops-decrypted from git (cc-ci-secrets) at activation
+# (modules/secrets.nix wildcard_cert/wildcard_key), NOT an out-of-band operator file drop.
 #
 # Declared as an idempotent-RECONCILE systemd oneshot (like swarm-init): it inspects current
 # state and converges every activation/boot, self-healing drift (redeploys if the stack is gone,
@@ -16,9 +18,11 @@ let
       CERT_DIR="/var/lib/ci-certs/live"
       ENV_FILE="$HOME/.abra/servers/default/$PROXY_DOMAIN.env"
 
-      # Fail visibly (failed unit) if the operator cert is missing — do NOT silently skip.
+      # Fail visibly (failed unit) if the cert is missing — do NOT silently skip. It is
+      # sops-decrypted from git (cc-ci-secrets) at activation; a miss here means the sops decrypt
+      # path is broken (e.g. age identity not present), which must surface, not be papered over.
       if [ ! -r "$CERT_DIR/fullchain.pem" ] || [ ! -r "$CERT_DIR/privkey.pem" ]; then
-        echo "FATAL: wildcard cert missing at $CERT_DIR (operator precondition)" >&2
+        echo "FATAL: wildcard cert missing at $CERT_DIR (sops decrypt from cc-ci-secrets failed?)" >&2
         exit 1
       fi