modules/usb-devices.nix
# real secrets never enter the repo — only .example structure files are tracked
secrets/*
!secrets/*.example
result