use external secrets for password generation

flake.nix

@@ -32,7 +32,7 @@
         };
         dockerImage = pkgs.dockerTools.buildLayeredImage {
           name = "policy_service";
-          contents = [ package pkgs.busybox pkgs.shadow ];
+          contents = [ package pkgs.busybox pkgs.shadow beamPackages.mix ];
           config = {
             Cmd = [ "${package}/bin/policy_service" "start" ];
             Entrypoint = [ "/bin/sh" ];