terra: tome, rootless podman for GPU containers, direnv, kicad

- install tome from pkgs/tome.nix, built against the re-added flake input
- import services/containers.nix and put darman in `render`/`video`:
  /dev/dri/renderD128 is root:render 0660, so a rootless container can only
  reach the GPU if the host user is in the group. Needed by the Vulkan
  whisper.cpp/llama.cpp containers in content-trigger-scanner.
- point DOCKER_HOST at the podman *user* socket and add docker-compose.
  dockerCompat gives a `docker` CLI shim, but compose v2 is its own binary
  talking to a socket, and rootless podman's socket is the user one under
  /run/user/1000 — not root's /var/run/docker.sock.
- direnv + nix-direnv, so per-repo devShells load in the shell and in Rider
  via its direnv plugin, instead of hand-wiring a toolbox SDK per repo
- kicad as a flatpak, alongside the other flatpak desktop apps

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/terra/configuration.nix

@@ -13,6 +13,7 @@ in
     ./disk-config.nix
     ./secrets.nix
     ../../common.nix
+    ../../services/containers.nix
     ../../services/vpn/tailscale.nix
     ../../services/desktop/desktop-hyprland.nix
     ../../services/desktop/desktop-apps.nix
@@ -29,6 +30,7 @@ in
       { appId = "com.discordapp.Discord";  origin = "flathub"; }
       { appId = "org.telegram.desktop";   origin = "flathub"; }
       { appId = "com.bambulab.BambuStudio"; origin = "flathub"; }
+      { appId = "org.kicad.KiCad"; origin = "flathub"; }
     ];
   };
 
@@ -62,6 +64,11 @@ in
   hardware.enableRedistributableFirmware = true;
   boot.initrd.kernelModules = [ "amdgpu" ];
 
+  # /dev/dri/renderD128 is root:render 0660, so rootless podman containers can
+  # only reach the GPU if the *host* user is in render. Needed by the Vulkan
+  # whisper.cpp/llama.cpp containers in ~/Data/Dev/repos/content-trigger-scanner.
+  users.users.darman.extraGroups = [ "render" "video" ];
+
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
   fileSystems."/mnt/hdd_01" = {
     device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4";

hosts/terra/home.nix

@@ -1,5 +1,7 @@
-{ pkgs, unstable, ... }:
-
+{ pkgs, unstable, inputs, ... }:
+let
+  tome = pkgs.callPackage ../../pkgs/tome.nix { src = inputs.tome; };
+in
 {
   imports = [ ./home/hyprland.nix ./home/theme.nix ];
 
@@ -17,6 +19,22 @@
 
   programs.zsh.enable = true;
 
+  # direnv + nix-direnv: lets per-repo devShells (e.g. ~/Data/Dev/repos/Tome's
+  # flake.nix) auto-load in the shell AND in Rider via its "direnv
+  # integration" plugin, instead of every dev repo needing its own
+  # jetbrains-toolbox SDK wiring by hand.
+  programs.direnv = {
+    enable = true;
+    nix-direnv.enable = true;
+  };
+
+  # Rootless podman: containers run as darman, not root. services/containers.nix
+  # gives us the `docker` CLI shim (dockerCompat), but compose v2 is a separate
+  # binary and talks to a socket rather than the CLI — the NixOS podman module
+  # enables the *user* socket (systemd.user.sockets.podman), so point compose at
+  # it instead of the root /var/run/docker.sock.
+  home.sessionVariables.DOCKER_HOST = "unix:///run/user/1000/podman/podman.sock";
+
   xdg.userDirs = {
     enable = true;
   };
@@ -33,9 +51,11 @@
     pkgs.quickshell
     pkgs.github-cli
     pkgs.tea
+    pkgs.docker-compose
     pkgs.hyprcursor
     pkgs.bibata-cursors
     pkgs.papirus-icon-theme
+    tome
   ];
 
   xdg.desktopEntries.btop = {