feat(opencode): add workstation API key secret

modules/ai-tools.nix

@@ -1,9 +1,12 @@
 {inputs, ...}: {
 	den.aspects.ai-tools.homeManager = {
+		lib,
 		pkgs,
 		inputs',
 		...
-	}: {
+	}: let
+		opencodeSecretPath = "/run/secrets/opencode-api-key";
+	in {
 		home.packages = [
 			inputs'.llm-agents.packages.claude-code
 			inputs'.llm-agents.packages.pi
@@ -11,6 +14,13 @@
 			pkgs.cog-cli
 		];
 
+		programs.nushell.extraEnv =
+			lib.mkAfter ''
+				if ("${opencodeSecretPath}" | path exists) {
+					$env.OPENCODE_API_KEY = (open --raw "${opencodeSecretPath}" | str trim)
+				}
+			'';
+
 		home.file = {
 			"AGENTS.md".source = ./_ai-tools/AGENTS.md;
 			".pi/agent/extensions/pi-elixir" = {