fix: don't symlink deepseek-apikey secret

This causes .local/state to be mkdir'ed with root:root ownership

home/gabriel/features/opencode/default.nix

@@ -1,6 +1,4 @@
-{config, ...}: let
-  secrets = "${config.xdg.stateHome}/opencode/secrets";
-in {
+{config, ...}: {
   xdg.desktopEntries.opencode = {
     name = "Opencode";
     genericName = "AI CLI Assistant";
@@ -29,7 +27,7 @@ in {
     enable = true;
     settings = {
       provider.deepseek.options = {
-        apiKey = "{file:${secrets}/deepseek-apikey}";
+        apiKey = "{file:/run/secrets/deepseek-apikey}";
       };
       autoupdate = false;
       model = "deepseek/deepseek-v4-pro";

hosts/common/users/gabriel/default.nix

@@ -5,7 +5,6 @@
   ...
 }: let
   ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
-  inherit (config.home-manager.users.gabriel.xdg) stateHome;
 in {
   users.mutableUsers = false;
   users.users.gabriel = {
@@ -42,12 +41,10 @@ in {
     firefly-pat = {
       sopsFile = ../../secrets.yaml;
       owner = "gabriel";
-      path = "${stateHome}/opencode/secrets/firefly-pat";
     };
     deepseek-apikey = {
       sopsFile = ../../secrets.yaml;
       owner = "gabriel";
-      path = "${stateHome}/opencode/secrets/deepseek-apikey";
     };
   };