zsh/: source ~/.zshrc.local for per-machine secrets

~/.zshrc is managed and overwritten on every bootstrap, so there was
nowhere to put a machine-local key. The managed rc now sources
~/.zshrc.local last (so it can override anything) and bootstrap never
touches that file. zshrc.local.example documents the variables modules
look for: GITEA_KEY, LITELLM_KEY, OP_SERVICE_ACCOUNT_TOKEN.

Secrets stay out of the repo — zsh/zshrc is shared config applied to
every box.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

zsh/zshrc.local.example

@@ -0,0 +1,26 @@
+# ~/.zshrc.local — per-machine customizations. Copy this file to
+# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
+# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
+# lives in the repo — this is the ONLY place to put secrets.
+#
+#   cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local
+
+# --- Gitea -------------------------------------------------------------
+# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
+# auth itself goes through credential.helper store, see git/).
+# export GITEA_KEY=...
+
+# --- covert-gpt LiteLLM gateway -----------------------------------------
+# LITELLM_KEY is normally exported by mcp-config's sync hook from
+# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
+# setting it here. Only set it here on a box without mcp-sync:
+# export LITELLM_KEY=sk-...
+
+# --- 1Password CLI -------------------------------------------------------
+# Service-account token for non-interactive `op read` / `op run`.
+# export OP_SERVICE_ACCOUNT_TOKEN=ops_...
+
+# --- Anything else -------------------------------------------------------
+# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
+# so it can override anything the managed zshrc sets.
+# export KUBECONFIG="$HOME/.kube/homelab.yaml"