- secrets submodule -> cdd5e0a (adds sops dockerhub_auth = base64 nptest2:PAT). - nix/modules/secrets.nix: sops.secrets.dockerhub_auth + sops.templates."docker-config.json" renders /root/.docker/config.json (0600 root) so abra/docker pulls authenticate (200/6h per-account) instead of the exhausted 100/6h shared-IP anon limit. Survives 1c rebuild. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>