fix(user): enforce declarative password management

Set mutableUsers = false to ensure password is managed declaratively
via hashedPasswordFile. Updated password hash in SOPS secrets.

Also adds nixos-config-researcher agent for Claude Code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

modules/system/user.nix

@@ -5,6 +5,7 @@
   ...
 }: {
   users = {
+    mutableUsers = false;
     users = {
       ${myConfig.nixos.username} = {
         isNormalUser = true;