flake: re-add the tome input, refresh locked inputs

Tome (formerly AudibleLibrary) comes back as a git+ssh input against our own
gitea, fetched with darman's ambient key. `flake = false` — it's a plain
source tree consumed by pkgs/tome.nix, not a flake of its own.

This re-breaks `./scripts/deploy install terra localhost` exactly the way
4f79ec7 removed it for: the installer-iso has no credentials, so the git+ssh
fetch fails at nixos-install, post-disko. Taking that tradeoff knowingly
rather than losing the app from the desktop config again — the note in
flake.nix spells it out for whoever hits it next.

The lock also picks up the routine input refresh, including the nixos-26.05
rev that finally carries the tailscale vendorHash fix (next commit) and a new
client-ts-generator-src node pulled in by authentik-nix.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

flake.nix

@@ -43,10 +43,19 @@
       url = "git+https://git.mgaction.town/darman/hypr-chrome.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # NOTE: the `tome` input (private repo git+ssh://gitea@git.mgaction.town) was
-    # removed temporarily — the credential-less installer-iso can't fetch it, so
-    # `install terra localhost` failed at nixos-install (post-disko). Re-add it
-    # (input + packages.tome + desktop-apps.nix) once the installer can auth.
+    # Tome (formerly AudibleLibrary) — darman's own .NET/Photino desktop app.
+    # Private repo on our own gitea; fetched over ssh with darman's ambient key,
+    # same as any other git flake input. `flake = false`: it's a plain source
+    # tree, not itself a flake. See pkgs/tome.nix.
+    #
+    # NOTE: the credential-less installer-iso can't fetch this (git+ssh needs
+    # darman's key), so `./scripts/deploy install terra localhost` will fail
+    # at nixos-install (post-disko) while this input is present. Known
+    # tradeoff — re-removed this once before (4f79ec7) for the same reason.
+    tome = {
+      url = "git+ssh://gitea@git.mgaction.town:2222/darman/TOME.git";
+      flake = false;
+    };
   };
 
   outputs = { self, nixpkgs, disko, nixos-anywhere, sops-nix, nixos-images, home-manager, mediamanager-nix, authentik-nix, ... }@inputs: