terra: desktop setup, flatpak, unstable packages, key management

- Hyprland workspace rules: start-communications.sh launches telegram +
  discord into special:communications; qbz/discord/telegram switched to
  flatpak (nix-flatpak, Flathub) — removes qbz and proton-pass-cli flake
  inputs
- proton-pass-cli and claude-code sourced from nixpkgs-unstable; unstable
  pkgs set threaded into home-manager via extraSpecialArgs
- GTK/libadwaita dark theme fixed: dconf color-scheme = prefer-dark written
  declaratively instead of a per-session gsettings call
- scripts/keys: store/restore SSH host keys and sops age keys via Proton
  Pass (ssh_host#<config> / age#<config> / age#admin naming)

flake.nix

@@ -3,10 +3,6 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-    # Second nixpkgs, used for ONE package: immich. 26.05 pins 2.7.5, but
-    # jupiter's imported database was written by 3.0.0 and immich never
-    # migrates a schema backwards. NOT `follows` — the point is a different
-    # package set. See services/media/immich.nix.
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     disko = {
       url = "github:nix-community/disko";
@@ -16,18 +12,10 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # NB: no `inputs.nixpkgs.follows` here — nixos-images has no `nixpkgs`
-    # input (it takes nixos-stable / nixos-unstable), so declaring one only
-    # printed "override for a non-existent input" on every nix command.
     nixos-images = {
       url = "github:nix-community/nixos-images";
       inputs.nixos-stable.follows = "nixpkgs";
     };
-    # Pinned as an input rather than `nix run github:...` from scripts/deploy.
-    # Both it and disko run at the exact moment a disk is being wiped, so the
-    # revision has to come from flake.lock — reviewed, reproducible, and
-    # resolvable from the local store — instead of whatever upstream master
-    # happens to be that day (which also fails outright with no network).
     nixos-anywhere = {
       url = "github:nix-community/nixos-anywhere";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -43,16 +31,13 @@
       url = "github:strangeglyph/mediamanager-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # Deliberately NOT `inputs.nixpkgs.follows` — upstream states overriding it
-    # breaks their pinned python dependency set. Costs a second nixpkgs in the
-    # lock; builds come prebuilt from nix-community's Cachix.
     authentik-nix.url = "github:nix-community/authentik-nix";
-    # Unofficial packaging of Proton's pass-cli (not in nixpkgs) — used by
-    # ./scripts/deploy to pull sudo/ssh passwords from the "HomeLab" vault.
     proton-pass-cli = {
       url = "github:tomsch/proton-pass-cli-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix-flatpak.url = "github:gmodena/nix-flatpak";
+    qbz.url = "github:vicrodh/qbz";
     # NOTE: the `tome` input (private repo git+ssh://gitea@git.mgaction.town) was
     # removed temporarily — the credential-less installer-iso can't fetch it, so
     # `install terra localhost` failed at nixos-install (post-disko). Re-add it
@@ -105,6 +90,7 @@
             disko.nixosModules.disko
             sops-nix.nixosModules.sops
             home-manager.nixosModules.home-manager
+            inputs.nix-flatpak.nixosModules.nix-flatpak
             ./hosts/terra/configuration.nix
           ];
         };