simplify secrets file format

Each secret file to be deployed is now backed by one local file.
This simplifies 'setup-secrets' and the secret definitions.
Also, with the old format it was not possible to add new secrets
to secrets.nix in a simple way.

Old secrets are automatically converted to the new format when running
nix-shell.

Using the new option 'nix-bitcoin.secrets', secrets are now directly
defined by the services that use them.

modules/nanopos.nix

@@ -58,7 +58,7 @@ in {
       requires = [ "lightning-charge.service" ];
       after = [ "lightning-charge.service" ];
       serviceConfig = {
-        EnvironmentFile = "/secrets/lightning-charge-api-token-for-nanopos";
+        EnvironmentFile = "/secrets/nanopos-env";
         ExecStart = "${pkgs.nix-bitcoin.nanopos}/bin/nanopos -y ${cfg.itemsFile} -p ${toString cfg.port} --show-bolt11";
 
         User = "nanopos";
@@ -73,5 +73,6 @@ in {
       group = "nanopos";
     };
     users.groups.nanopos = {};
+    nix-bitcoin.secrets.nanopos-env.user = "nanopos";
   };
 }