terra: desktop setup, flatpak, unstable packages, key management

- Hyprland workspace rules: start-communications.sh launches telegram +
  discord into special:communications; qbz/discord/telegram switched to
  flatpak (nix-flatpak, Flathub) — removes qbz and proton-pass-cli flake
  inputs
- proton-pass-cli and claude-code sourced from nixpkgs-unstable; unstable
  pkgs set threaded into home-manager via extraSpecialArgs
- GTK/libadwaita dark theme fixed: dconf color-scheme = prefer-dark written
  declaratively instead of a per-session gsettings call
- scripts/keys: store/restore SSH host keys and sops age keys via Proton
  Pass (ssh_host#<config> / age#<config> / age#admin naming)

hosts/terra/home.nix

@@ -1,28 +1,23 @@
 { pkgs, ... }:
 
-# home-manager profile for darman on terra. System-level Hyprland enable
-# (session entry, portals) lives in ../../services/desktop/desktop-hyprland.nix; this
-# manages the user's own hyprland.conf + session packages.
+# home-manager profile for darman on terra. The Hyprland config lives in its
+# own module (./hyprland.nix); this handles the rest of the user session
+# (theming, terminal, packages).
 {
-  home.stateVersion = "26.05";
+  imports = [ ./home/hyprland.nix ];
 
-  wayland.windowManager.hyprland = {
-    enable = true;
-    # Starter config — replace with your real dotfiles.
-    settings = {
-      monitor = [ ",preferred,auto,1" ];
-      "$mod" = "SUPER";
-      bind = [
-        "$mod, Return, exec, alacritty"
-        "$mod, Q, killactive"
-        "$mod, D, exec, wofi --show drun"
-      ];
-    };
-  };
+  home.stateVersion = "26.05";
+  home.keyboard.layout = "de";
 
   programs.git.enable = true;
   programs.home-manager.enable = true;
 
+  # Give darman a managed ~/.zshrc. Without any zsh dotfile, zsh runs its
+  # first-run `zsh-newuser-install` prompt on every new terminal. oh-my-zsh +
+  # powerlevel10k still come from the system /etc/zshrc (common.nix), which
+  # always loads for interactive shells before this ~/.zshrc.
+  programs.zsh.enable = true;
+
   # ---- Dracula theming (GTK + Qt) ----
   gtk = {
     enable = true;
@@ -58,20 +53,26 @@
   # be a package in home.packages, not a plain xdg.dataFile.
   xdg.mime.enable = true;
   xdg.configFile."quickshell".source = ../../dotfiles/quickshell;
+  xdg.configFile."scripts".source = ../../dotfiles/scripts;
   home.packages = [
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
     pkgs.claude-code
     pkgs.quickshell
     pkgs.opencode
+    pkgs.hyprcursor
+    pkgs.bibata-cursors
   ];
 
   programs.alacritty = {
     enable = true;
     settings = {
-      env.SHELL = "/bin/zsh";
+      # NixOS has no /bin/zsh (only /bin/sh); point at the real store path or
+      # alacritty exits instantly trying to exec a missing shell — which looked
+      # like "the SUPER+Return keybind doesn't work".
+      env.SHELL = "${pkgs.zsh}/bin/zsh";
       terminal.shell = {
-        program = "/bin/zsh";
+        program = "${pkgs.zsh}/bin/zsh";
         args = [ "-l" ];
       };
       window = {
@@ -86,17 +87,17 @@
         background = "#222831";
         foreground = "#ffd369";
       };
-      hints.enabled = [
-        {
-          hyperlinks = true;
-          regex = "(ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh:|ftp://)[^\\u0000-\\u001F\\u007F-\\u009F<>\"\\s{-}\\^⟨⟩`]+";
-          command = "xdg-open";
-          mouse.enabled = true;
-        }
-      ];
+ #     hints.enabled = [
+ #       {
+ #         hyperlinks = true;
+ #         regex = "(ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh:|ftp://)[^\\u0000-\\u001F\\u007F-\\u009F<>\"\\s{-}\\^⟨⟩`]+";
+ #         command = "xdg-open";
+ #         mouse.enabled = true;
+ #       }
+ #     ];
       keyboard.bindings = [
-        # ESC + CR: nix strings have no \u escape, so fromJSON (which
-        # supports \u001B) is used to get the literal control chars here.
+        # ESC + CR: nix has no literal escape for the ESC control char, so
+        # fromJSON decodes it from the JSON unicode escape below.
         { key = "Return"; mods = "Shift"; chars = builtins.fromJSON ''"\u001B\r"''; }
       ];
     };