Set mutableUsers = false to ensure password is managed declaratively
via hashedPasswordFile. Updated password hash in SOPS secrets.
Also adds nixos-config-researcher agent for Claude Code.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>