terra: desktop setup, flatpak, unstable packages, key management

- Hyprland workspace rules: start-communications.sh launches telegram +
  discord into special:communications; qbz/discord/telegram switched to
  flatpak (nix-flatpak, Flathub) — removes qbz and proton-pass-cli flake
  inputs
- proton-pass-cli and claude-code sourced from nixpkgs-unstable; unstable
  pkgs set threaded into home-manager via extraSpecialArgs
- GTK/libadwaita dark theme fixed: dconf color-scheme = prefer-dark written
  declaratively instead of a per-session gsettings call
- scripts/keys: store/restore SSH host keys and sops age keys via Proton
  Pass (ssh_host#<config> / age#<config> / age#admin naming)

hosts/terra/configuration.nix

@@ -18,6 +18,16 @@
 
   networking.hostName = "terra";
 
+  services.flatpak = {
+    enable = true;
+    remotes = [{ name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo"; }];
+    packages = [
+      { appId = "com.blitzfc.qbz";        origin = "flathub"; }
+      { appId = "com.discordapp.Discord";  origin = "flathub"; }
+      { appId = "org.telegram.desktop";   origin = "flathub"; }
+    ];
+  };
+
   # Proton Pass CLI — not in nixpkgs; ./scripts/deploy uses it to autofill
   # sudo/ssh passwords from the "HomeLab" vault. Packaged by the
   # proton-pass-cli flake input (github:tomsch/proton-pass-cli-nix).
@@ -34,6 +44,17 @@
   boot.loader.efi.canTouchEfiVariables = true;
   hardware.cpu.amd.updateMicrocode = true;
 
+  # ---- GPU (Radeon RX 6800 XT / Navi 21) ----
+  # amdgpu needs the redistributable navi21 firmware blobs to bind the card.
+  # Without them the module loads but never initialises the GPU: there's no
+  # DRM card for it, the display falls back to the 1024x768 EFI
+  # simple-framebuffer as "Unknown-1", and the real DP-2/HDMI-A-1 outputs
+  # never appear — so hyprland's monitor rules match nothing.
+  hardware.enableRedistributableFirmware = true;
+  # Early KMS: bind amdgpu in the initrd so it drives the console + greeter
+  # from boot instead of handing over from simple-framebuffer later.
+  boot.initrd.kernelModules = [ "amdgpu" ];
+
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
   # UUIDs captured from the running CachyOS box; verify after install
   # (`lsblk -o NAME,UUID,MOUNTPOINT`) in case disko/kernel enumerates differently.