terra: add Ryzen 9 5900X desktop (Hyprland, tailnet, dev tools)

Replaces CachyOS on the OS SSD (Kingston SA400, disko-managed). Dev-data
disks (sdc ext4 /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) stay out of disko and
are mounted as plain filesystems so they're never wiped. Desktop split into
services/desktop/desktop-hyprland.nix (session: compositor, greeter, audio,
portals) and desktop-apps.nix (things darman actually launches, including
claude-code — allowlisted alongside the other unfree desktop apps).

.sops.yaml

@@ -12,6 +12,7 @@ keys:
   # (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
   - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
   - &neptun age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
+  - &terra age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
   # mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
   # the private key is dropped on its boot partition after flashing.
   - &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
@@ -24,6 +25,9 @@ creation_rules:
   - path_regex: secrets/neptun\.yaml$
     key_groups:
       - age: [ *admin, *neptun ]
+  - path_regex: secrets/terra\.yaml$
+    key_groups:
+      - age: [ *admin, *terra ]
   - path_regex: secrets/mercury\.yaml$
     key_groups:
       - age: [ *admin, *mercury ]