terra: tome, rootless podman for GPU containers, direnv, kicad

- install tome from pkgs/tome.nix, built against the re-added flake input
- import services/containers.nix and put darman in `render`/`video`:
  /dev/dri/renderD128 is root:render 0660, so a rootless container can only
  reach the GPU if the host user is in the group. Needed by the Vulkan
  whisper.cpp/llama.cpp containers in content-trigger-scanner.
- point DOCKER_HOST at the podman *user* socket and add docker-compose.
  dockerCompat gives a `docker` CLI shim, but compose v2 is its own binary
  talking to a socket, and rootless podman's socket is the user one under
  /run/user/1000 — not root's /var/run/docker.sock.
- direnv + nix-direnv, so per-repo devShells load in the shell and in Rider
  via its direnv plugin, instead of hand-wiring a toolbox SDK per repo
- kicad as a flatpak, alongside the other flatpak desktop apps

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/terra/configuration.nix

@@ -13,6 +13,7 @@ in
     ./disk-config.nix
     ./secrets.nix
     ../../common.nix
+    ../../services/containers.nix
     ../../services/vpn/tailscale.nix
     ../../services/desktop/desktop-hyprland.nix
     ../../services/desktop/desktop-apps.nix
@@ -29,6 +30,7 @@ in
       { appId = "com.discordapp.Discord";  origin = "flathub"; }
       { appId = "org.telegram.desktop";   origin = "flathub"; }
       { appId = "com.bambulab.BambuStudio"; origin = "flathub"; }
+      { appId = "org.kicad.KiCad"; origin = "flathub"; }
     ];
   };
 
@@ -62,6 +64,11 @@ in
   hardware.enableRedistributableFirmware = true;
   boot.initrd.kernelModules = [ "amdgpu" ];
 
+  # /dev/dri/renderD128 is root:render 0660, so rootless podman containers can
+  # only reach the GPU if the *host* user is in render. Needed by the Vulkan
+  # whisper.cpp/llama.cpp containers in ~/Data/Dev/repos/content-trigger-scanner.
+  users.users.darman.extraGroups = [ "render" "video" ];
+
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
   fileSystems."/mnt/hdd_01" = {
     device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4";