Session overhaul: dev tooling, cleanup, theming, fixes

Tooling:
- nh + nvd/nom/statix/deadnix/comma (new programs/nix.nix); GC via nh clean
- zoxide (cd), atuin, just, lazydocker, dust, duf, difftastic (git dft)

Structure:
- rename desktop -> konishi; homeConfigurations -> "user@host" for nh autodetect

Removals (heavy/unused):
- android-studio, unity/.NET/omnisharp/vscode, kicad, zoom, calibre,
  google-fonts, nerd-dictation

Screen recording:
- kooha + vokoscreen-ng + `webcam` corner-cam command/window-rule

Fixes:
- WEBKIT_DISABLE_DMABUF_RENDERER moved to common (electron/tauri on intel)
- kitty pinned to Catppuccin-Mocha; darkman no longer toggles kitty/claude
- claude theme dark + statusline locale fix
- ssh: migrate to settings API + multiplexing/keepalive/AddKeysToAgent;
  gpg-agent enableSshSupport
- silence hyprland configType / gtk4 / xdg userDirs deprecations

Flake hygiene:
- follows=nixpkgs for foundry/hardware/rose-pine/zen/spicetify (10->5 nixpkgs)
- zoxide _ZO_DOCTOR=0

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hosts/arrakis/default.nix

@@ -20,7 +20,6 @@
     ../common/features/nix-ld.nix
     ../common/features/bluetooth.nix
     ../common/features/ledger.nix
-    ../common/features/android-studio.nix
     ../common/features/home
   ];
 
@@ -33,11 +32,43 @@
 
   users.users.naps62.extraGroups = [ "video" ];
 
-  # IPU6 webcam — kernel/firmware support only
-  # Camera works via libcamera (cam -l, cam -c 1 --capture) but no
-  # reliable browser integration yet without always-on LED
-  hardware.firmware = [ pkgs.ivsc-firmware ];
-  environment.systemPackages = [ pkgs.libcamera ];
+  # IPU6 webcam (Dell XPS 9320, Alder Lake, ov01a10 sensor).
+  # Uses Intel's hardware ISP via the official hardware.ipu6 module: the
+  # proprietary HAL (ipu6-camera-bins/-hal + icamerasrc) feeds v4l2-relayd,
+  # which exposes a normal /dev/video50 ("Intel MIPI Camera") that works in
+  # every app (Chrome, Zen, mpv, OBS, ...). The module also hides the 32 raw
+  # IPU6 nodes from WirePlumber/udev, which is what unbreaks Chrome.
+  #
+  # The relay is on-demand (v4l2-relayd opens the sensor only when an app opens
+  # the loopback device), so the LED should follow usage rather than stay on.
+  #
+  # Bare libcamera still works as a fallback (software ISP, poor quality):
+  #   libcamerify mpv av://v4l2:/dev/video0 --profile=low-latency --untimed
+  hardware.ipu6 = {
+    enable = true;
+    platform = "ipu6ep"; # Alder Lake / Raptor Lake
+  };
+
+  # v4l2-relayd exits whenever a consumer closes the loopback and relies on
+  # systemd to restart it for the next session. The default start-limit (5
+  # restarts / 10s) permanently kills it under rapid open/close (e.g. an app
+  # probing the device), leaving the camera dead until a manual restart.
+  # Disable the limit and throttle restarts so it always self-heals.
+  systemd.services.v4l2-relayd-ipu6 = {
+    startLimitIntervalSec = 0;
+    serviceConfig.RestartSec = "1";
+  };
+
+  # The module's rule to lock the raw IPU6 nodes to root gets clobbered by the
+  # default "video4linux -> group video" rule, so they stay user-readable and
+  # Chrome hangs enumerating all 32 of them. Re-assert with ':=' (locks the
+  # value against later rules), matched on the kernel-set ID_V4L_PRODUCT.
+  # GROUP/MODE alone isn't enough: logind's uaccess still leaves a stale
+  # "user:<you>:rw" ACL on the nodes, so also drop the uaccess tag and wipe any
+  # ACL on every event (setfacl -b) to keep the raw nodes truly root-only.
+  services.udev.extraRules = ''
+    SUBSYSTEM=="video4linux", ENV{ID_V4L_PRODUCT}=="ipu6", GROUP:="root", MODE:="0600", TAG-="uaccess", RUN+="${pkgs.acl}/bin/setfacl -b %N"
+  '';
 
   services.fprintd.enable = true;
 }