Block a user
vars/sops: store secrets in /sops/vars
sops/refactor: lay groundwork for secrets with arbitrary paths
secrets: refactor parameter naming
flake.nix: remove unnecessary newline
tests/generate_flake: support inventory argument
clan-cli/secrets: refactor: rename secret -> secret_path
vars: add support for password-store
clan-cli: replace run_cmd() with env_for_programs()