fix: restore local-session HM routing and update shared sops key path

modules/secrets/sops.nix

@@ -8,6 +8,7 @@ in
       { host, ... }:
       let
         missingAdminUsers = lib.filter (userName: !(builtins.hasAttr userName host.users)) host.sopsAdminKeyUsers;
+        hasSharedAdminKey = host.sopsAdminKeyPath != null && host.sopsAdminKeyUsers != [ ];
         adminKeyDir = if host.sopsAdminKeyPath == null then null else builtins.dirOf host.sopsAdminKeyPath;
       in
       {
@@ -27,7 +28,7 @@ in
                 };
           };
 
-          users.groups = lib.optionalAttrs (host.sopsAdminKeyUsers != [ ]) {
+          users.groups = lib.optionalAttrs hasSharedAdminKey {
             ${sopsReadersGroup} = { };
           };
 
@@ -35,8 +36,9 @@ in
             extraGroups = [ sopsReadersGroup ];
           });
 
-          systemd.tmpfiles.rules = lib.optionals (adminKeyDir != null) [
+          systemd.tmpfiles.rules = lib.optionals hasSharedAdminKey [
             "d ${adminKeyDir} 0750 root ${sopsReadersGroup} -"
+            "z ${host.sopsAdminKeyPath} 0640 root ${sopsReadersGroup} -"
           ];
 
           assertions = [