feat(amd): add opencode web server at opencode.amd.hoyer.world

Mirror of the sgx opencode setup: systemd service on port 4196 fronted
by nginx with a per-host ACME cert (DNS-01 via internetbs). Adds amd
key + path rule to .sops.yaml so secrets under .secrets/amd/ encrypt
for the host.

.secrets/amd/opencode-web.yaml

@@ -0,0 +1,34 @@
+opencode-web-password: ENC[AES256_GCM,data:u1Rw15snERc7+zkW2rZS91fadbuLk1msfEBIqe+bHVno6cdJabXoznsxtPyDnN/4G1+hHMZvBIWCSzNzoB78XMh4P/hmRr8=,iv:snqYkpsUQZL020wqitNneD3v2E3eM2VddzkrzaUEwBw=,tag:eAkktHW3bdYcwvWrjhppxw==,type:str]
+sops:
+    age:
+        - recipient: age1u2glh4g65qjvlcan7u7qmhdlpvxqkc2h48m5zka8nafjrfnt5e3ss494vt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRGkxeHdKUDZ3U3ZZM1Bu
+            cGxiTlNLMk5seWVrTW80WHgyVGhTRDVKWUFJCkROYkhnaVBONjVidHEwdUVSWVlk
+            dG53V0xkV3JlRjh0N01HbGxHbFdvUHMKLS0tIFVuQkZWRi8vTmJXbnc3Mjc1TlNy
+            YnFKRk5DbUZrNEVLWUZ0UWRQWE9ZZlkKCav6B/v1Gf1mPn8bgUVgFHqTACbIVzZX
+            8BODNMIbGYKRzLRWYr/UDMGnNONW+2i9o4Czei0yeb0sT9yZ9EozBQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhY1BCTUFJR2x2OEowcU5M
+            L0xCcUxZR2lzb3lBamJNR3hQMTZSRDlGeEY4Cm5Ea0hZQjI2SmRiTGw2bUZZT1Rn
+            SWhUTlJjNE1ZWmhDa05FSGRnV1A4L0kKLS0tIDRKK3l0VXE5aGkvNnNpbnVXUmNY
+            bmk0ekNuRzA2S2VFY0NhR0ZVRVhFWkUKyM/iL60iQ+qcxW4EtM6q7gkm+rqyMDqX
+            8rgh5sjjz03r7LujFkSyoXEEdylHsqW57Pp4sDyxpPcSeBbG1ubyNw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1cpm9xhgue7sjvq7zyeeaxwr96c93sfzxxxj76sxsq7s7kgnygvcq5jxren
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYm1vS2dja3V4emtSTzh4
+            ZUlCckxQbi9vNkE3M1lvcjFTRVlDRGxaaVRJCjQrU1JnUDlmZVBYbkJ5TTJuTnd5
+            MXBTbFhLRlFGWTJjbDZQZHBzUmdGclkKLS0tIHRoSmZ0Sm9hd3M4MVpiSkh4VjJK
+            T094Q0pWdWozRnZJd0ZKSisvQmlDUXcKRIvz33dKoJuP4YEEcNEkMMMmQZ3/bp9y
+            eDoUR+35e4/Q60NeUJzlNYfW/wobggUbx0fijXkTSbp+7C7YGkSgyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-03T13:14:50Z"
+    mac: ENC[AES256_GCM,data:VQ9TMo0QtPpgmkbYOJEwPG/RDPbScHCsJhFO+bhRJ64dazMwIKxO1DAsHF1298YeTbY5/EXly+8FS1kE5dQY1cGSy64fcSusM14k0a9Js0GxCz1NuJNlwzJVCZv5zjP8koH2B7PdIUhgI45zGIAuNcfP6dmtgy2vfGXcFg2cZpU=,iv:6cR1mYKoIkpVYrLN9z1Dd5CBOuizlhjau1TNbRqg2zA=,tag:7eKKsi6gS7PdIMZ0UOt90g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1