feat(work): headless Secret Service for gcx keychain tokens

gcx stores its OAuth access and refresh tokens in the system keychain
unconditionally -- its config file keeps only opaque `keychain:gcx:v2:...`
handles -- and exposes no plaintext fallback. With nothing owning
org.freedesktop.secrets on this headless WSL box, `gcx login` authenticates
against Grafana and then dies writing its config: "The name is not activatable".

Add services.headlessSecretService: gnome-keyring as a systemd --user service,
unlocking the login keyring at start. home-manager's own services.gnome-keyring
does not fit here on two counts -- it is WantedBy graphical-session-pre.target,
which never activates without a desktop session, and it passes no --unlock, so
writes would block on a GUI prompter that does not exist.

Only the secrets component is started. The ssh component is deliberately off: it
would claim SSH_AUTH_SOCK and displace services.ssh-agent, breaking SSH auth and
signed commits.

The unlock password defaults to a random one generated on first activation under
$XDG_DATA_HOME. The passwordFile option is the seam for supplying it from an
agenix secret instead, once that lands.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -30,7 +30,7 @@ profiles. The full module catalogue is below.
 flake.nix              # inputs, mkHost/mkDarwinHost, the host tables, dev shell + checks
 flake.lock             # pinned input revisions (Renovate keeps this fresh)
 modules/               # reusable NixOS system modules (see "Module catalogue")
-home/                  # home-manager profile: shell, git, editor, claude, desktop, sway
+home/                  # home-manager profile: shell, git, editor, claude, secret-service, desktop, sway
 users/                 # identity registry + per-user home extras (see "Users")
 hosts/<Name>/          # per-machine config: configuration.nix + hardware-configuration.nix
 lib/                   # small pure helpers (currently the Catppuccin Mocha palette)
@@ -94,8 +94,9 @@ Per-user home extras live under `users/<name>/`:
 - [`users/lyrathorpe/home.nix`](./users/lyrathorpe/home.nix) — personal extras
   (an ssh host shortcut, gammastep coordinates); imported on Lyra's hosts.
 - [`users/emmathorpe/work.nix`](./users/emmathorpe/work.nix) — the work
-  toolchain (kubectl/helm/az/etc.), work-only LSP servers, and the corporate ssh
-  handling; imports
+  toolchain (kubectl/helm/az/etc.), work-only LSP servers, the corporate ssh
+  handling, and the headless Secret Service that gcx needs for its keychain
+  tokens (see [`home/secret-service.nix`](./home/secret-service.nix)); imports
   [`users/emmathorpe/renovate-review.nix`](./users/emmathorpe/renovate-review.nix),
   the daily headless Renovate-PR review timer (EDaaS only).