terra: package Tome, add vivaldi + dotnet dev tools

Tome (née AudibleLibrary) is darman's own Photino/.NET desktop app, private
repo on our own gitea. Fetched as a flake input over ssh with darman's
ambient key — same mechanism as any other git input, private or not.

buildDotnetModule package: the Preact/Vite frontend (Tome.App/ClientApp)
builds as its own buildNpmPackage derivation and gets copied into the
published app's wwwroot, since upstream's in-project MSBuild npm target has
no network access in the Nix sandbox. Photino.Native's runtime deps (gtk3,
webkitgtk_4_1, libnotify) are wrapped in — confirmed via readelf/ldd that
this Photino build already targets webkit2gtk-4.1, not the now-removed 4.0.

Also added dotnet-sdk + nodejs to terra for developing Tome locally, and
vivaldi (unfree, extends the existing allowUnfreePredicate).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.nix

@@ -38,6 +38,14 @@
       url = "github:tomsch/proton-pass-cli-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # Tome (formerly AudibleLibrary) — darman's own .NET/Photino desktop app.
+    # Private repo on our own gitea; fetched over ssh with darman's ambient key,
+    # same as any other git flake input. `flake = false`: it's a plain source
+    # tree, not itself a flake. See pkgs/tome.nix.
+    tome = {
+      url = "git+ssh://gitea@git.mgaction.town:2222/darman/TOME.git";
+      flake = false;
+    };
   };
 
   outputs = { self, nixpkgs, disko, sops-nix, nixos-images, home-manager, mediamanager-nix, authentik-nix, ... }@inputs:
@@ -45,6 +53,10 @@
       system = "x86_64-linux";
     in
     {
+      packages.${system}.tome = nixpkgs.legacyPackages.${system}.callPackage ./pkgs/tome.nix {
+        src = inputs.tome;
+      };
+
       nixosConfigurations = {
         # Real host — install on the ZimaBlade.
         # disko owns the OS-disk partitioning + filesystems (see disk-config.nix).