refactor(opencode): extract serve service into shared NixOS module

New `metacfg.services.opencode` module under modules/nixos/services/opencode/
with options for port, user, homeDir, sopsFile, and extraPackages. User and
homeDir default off `metacfg.user`. Host configs for amd and sgx reduce to
enabling the module and pointing at their respective sops file.

Service PATH gains jq, yq-go, python3, gh, gnutar, gzip, unzip, wget,
diffutils, patch, file, tree, bun, uv, ast-grep, claude-code, and tmux for
agent ergonomics.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

systems/x86_64-linux/amd/opencode.nix

@@ -1,65 +1,9 @@
 {
-  config,
-  pkgs,
-  lib,
   ...
 }:
-
-let
-  port = 4196;
-  user = "harald";
-  homeDir = "/home/harald";
-in
 {
-  systemd.services.opencode-serve = {
-    description = "OpenCode Web Server";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-
-    path = with pkgs; [
-      git
-      bash
-      coreutils
-      findutils
-      gnused
-      gnugrep
-      gawk
-      gnumake
-      nix
-      nodejs
-      ripgrep
-      fd
-      curl
-      which
-    ];
-
-    environment = {
-      HOME = homeDir;
-      LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
-    };
-
-    serviceConfig = {
-      Type = "simple";
-      User = user;
-      Group = "users";
-      WorkingDirectory = homeDir;
-      ExecStart = "${pkgs.opencode}/bin/opencode serve --hostname 127.0.0.1 --port ${toString port}";
-      Restart = "always";
-      RestartSec = 5;
-      EnvironmentFile = config.sops.secrets.opencode-web-password.path;
-
-      # Security hardening
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = false;
-      NoNewPrivileges = true;
-      ReadWritePaths = [ homeDir ];
-    };
-  };
-
-  sops.secrets.opencode-web-password = {
+  metacfg.services.opencode = {
+    enable = true;
     sopsFile = ../../../.secrets/amd/opencode-web.yaml;
-    owner = user;
-    restartUnits = [ "opencode-serve.service" ];
   };
 }