Refactor: Move shell logic from home/dotfiles.nix to dedicated scripts

[kuznero]

Description

The current implementation of home.activation.opencodeAuth in home/dotfiles.nix embeds a multi-line shell script directly within a Nix string. This makes the logic difficult to lint, test, and maintain.

Implementation Requirements

1. Create the Shell Script

Create a new file at home/scripts/opencode-auth-setup.sh. The script must:

• Accept the path to the authentication file as its first argument, or default to "$HOME/.local/share/opencode/auth.json".
• Ensure the directory containing the file exists (mkdir -p).
• Initial Setup: If the file does not exist, create it with the content: {"ollama":{"type":"api","key":"ollama"}}.
• Validation: If the file exists, check if it is valid JSON using jq. If invalid, print a warning to stderr and exit with code 0.
• Update Logic: If valid, use jq to ensure the ollama key exists. If missing, append it: . + {"ollama": {"type": "api", "key": "ollama"}}.
• Atomicity: Use a temporary file for the jq transformation and mv it to the target location.
• Safety: Use set -euo pipefail and ensure the script is executable.

2. Update Nix Configuration

Modify home/dotfiles.nix to:

• Remove the inline shell script from home.activation.opencodeAuth.
• Ensure the new script is available in the user's environment.
• Call the script within the home.activation.opencodeAuth block.

Definition of Done (DoD)

• The shell script is located at home/scripts/opencode-auth-setup.sh.
• The shell script passes shellcheck.
• home/dotfiles.nix no longer contains the inline shell script.
• The activation logic correctly performs the same operations as the original code.
• The change does not break the Nix configuration.