terra: add Ryzen 9 5900X desktop (Hyprland, tailnet, dev tools)

Replaces CachyOS on the OS SSD (Kingston SA400, disko-managed). Dev-data
disks (sdc ext4 /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) stay out of disko and
are mounted as plain filesystems so they're never wiped. Desktop split into
services/desktop/desktop-hyprland.nix (session: compositor, greeter, audio,
portals) and desktop-apps.nix (things darman actually launches, including
claude-code — allowlisted alongside the other unfree desktop apps).

secrets/terra.yaml

@@ -0,0 +1,26 @@
+tailscale_authkey: ENC[AES256_GCM,data:5ZaIjgl4d380JGUC+GjhGUeoAkkrS8ky,iv:oRh/7v/od+Mxj+i3z2ouZ0H2NrUYujEiFR+fEODlaNU=,tag:xUbVxCoYqa1eGx2zvVRAnw==,type:str]
+darman_password: ENC[AES256_GCM,data:aM6jV2KkNlfZBEDvIZ1VpJl+6VSS/zm0AxAohV+WBhcMYdCmIGrmJYArhxNjN5Kk9TyRrLZVNnpzeM5RB6g394NAhznWHumctMN8fiq3x5/YOXVEn9DGxvc+4wj3E3PWWu44nRmdXHo6Wg==,iv:SBh11ZB34TrzZNxKIw5TKLUFvoC65vMVDTuvfjjKd/g=,tag:dYwn+fdbMAQBOHsP9wasjA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWkt2MXlGUVZGUlYyRS81
+            TDE2aFg5WGF3ZVcyMGEzSlR3aThwWU1QelNzClFYSll1K0kwMEYvQ3o5U2RKdnpu
+            UVZibUV2Z1FCcCtPRzROaW1RSk85M3cKLS0tIDdnRGpzS2dwYUc4ZlV5M1JlQURy
+            cWVDb1F2TTBSL2psTFdGaGRzb3JCaEEKBYdo2x/fjnU14hWI6ic3t2zmA8JioxVI
+            TEH3G9kPfWgcMdh1ORwykNnfcoSZcYM0EjomFDv5ZVjuZvRLDRDblA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZUFTNVJRdTBJbzZIZHQ4
+            VWRRSVJTbHFxNVVGTEZGT1ZqZnduQm1OSXg0CjZTU2p2YU9sUWZQTmJwNUFSVUFG
+            ZmJuOUVoMHZNQjlCeGFOcU9GaE5UUG8KLS0tIGtIL0t2cjM4ekl0clN2bERrRFlH
+            QW8rZHpwRTJYbWxUbnNTNUplL2dRRmcKujP0nL2Tu8/kDALDQsvEpaMLFWeMAtsk
+            sHjKfw8VrrmAR4pQf1dsY+wcyh4FsZxhP3Q+QIVq3eCIXS9PeJkGAg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
+    lastmodified: "2026-07-14T19:48:05Z"
+    mac: ENC[AES256_GCM,data:ne2YPbCG2U6ix/C+bua28qAEKEMJ4NkEmrg0qFw3iMs8l4gSKL0wVrEu7H6EimCUohdiZ24g4s8euRU60bPNrM1cKkFnDPfkIY4Lc33dI/JrKahjHrEafhpQNy85i2l7oxM1WnHOGfgkQ/XoicwInDwcM5Z8Ks4Sa1JnhYVwCFc=,iv:VnbreolrFp97Caim+sxB5MGW01ir3vyOTL3fJ8DDWwY=,tag:+4TusjszEXQFCUjP3F/IgQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1