Document that secretFile/adminAccount.passwordFile are read as cfg.user

hortusfox-setup reads both files as cfg.user, not root. Pointing either
at an agenix/sops-nix secret without setting its owner/group to match
cfg.user/cfg.group fails the service with a permission error rather
than anything obviously related -- note it on both options.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nixos-module/default.nix

@@ -229,7 +229,11 @@ in {
         File with secret KEY=VALUE lines (APP_KEY, SMTP_PASSWORD, API keys,
         ...) appended verbatim to the generated .env at runtime. Keep it out
         of the Nix store in production (e.g. agenix/sops-nix); a store path
-        is fine for throwaway test configs.
+        is fine for throwaway test configs. Read by hortusfox-setup, which
+        runs as cfg.user rather than root -- if you point this at an
+        agenix/sops-nix secret, make sure its owner/group is set to
+        cfg.user/cfg.group (or make it world-readable), or the service fails
+        with a permission error.
       '';
     };
 
@@ -261,7 +265,9 @@ in {
         a fresh deployment has no way to log in at all. Only used on first
         boot (guarded by the same stateDir/.installed marker as
         migrate:fresh); changing it afterwards has no effect on an
-        existing account.
+        existing account. Read by hortusfox-setup, which runs as cfg.user
+        rather than root -- as with secretFile, make sure this file's
+        owner/group lets cfg.user read it.
 
         Seeds a user (name set via adminAccount.username, email via
         adminAccount.email), bcrypt-hashed via