chore: initial project scaffolding

Add project configuration, documentation and development tooling:
- flake.nix dev shell with Go, golangci-lint, turbojpeg
- .envrc sourcing sops-encrypted .secrets.env
- golangci-lint v2 config
- opencode.json MCP + LSP wiring
- AGENTS.md development guidelines

.envrc

@@ -0,0 +1,10 @@
+use flake
+
+# Load project-local secrets (sops-encrypted, gitignored). Decrypt on the fly
+# with this machine's age key so plaintext never touches disk. Requires the
+# age key at ~/.config/sops/age/keys.txt.
+if [[ -f .secrets.env ]]; then
+  set -a
+  eval "$(sops -d --output-type dotenv .secrets.env)"
+  set +a
+fi