treewide: add missing systemd ordering directives

In particular, we were missing `sops-install-secrets.service` in a ton
of places, and `network-online.target` for some homebrewn services.

This has caused failure of some services on machine startup.

hosts/lupine/services/openvpn.nix

@@ -94,6 +94,11 @@ in
     };
   };
 
+  systemd.services."openvpn-ov-firewall" = {
+    after = [ "sops-install-secrets.service" ];
+    requires = [ "sops-install-secrets.service" ];
+  };
+
   networking.firewall = {
     allowedTCPPorts = [ 1194 ];
     allowedUDPPorts = [ 1194 ];