terra: desktop setup, flatpak, unstable packages, key management

- Hyprland workspace rules: start-communications.sh launches telegram +
  discord into special:communications; qbz/discord/telegram switched to
  flatpak (nix-flatpak, Flathub) — removes qbz and proton-pass-cli flake
  inputs
- proton-pass-cli and claude-code sourced from nixpkgs-unstable; unstable
  pkgs set threaded into home-manager via extraSpecialArgs
- GTK/libadwaita dark theme fixed: dconf color-scheme = prefer-dark written
  declaratively instead of a per-session gsettings call
- scripts/keys: store/restore SSH host keys and sops age keys via Proton
  Pass (ssh_host#<config> / age#<config> / age#admin naming); no jq dep,
  uses pass-cli --field directly
- jq added to desktop-apps system packages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/keys

@@ -31,7 +31,6 @@ die()  { echo "error: $*" >&2; exit 1; }
 need() { command -v "$1" >/dev/null 2>&1 || die "missing required tool: $1"; }
 
 need pass-cli
-need jq
 
 # Resolve an active vault item by title → item ID, or empty string.
 # Active-only filter avoids the trashed-item-shadows-active bug (see deploy).
@@ -101,18 +100,19 @@ store_age_key() {
 # ---------------------------------------------------------------------------
 
 restore_ssh_key() {
-  local config="$1" title="ssh_host#$1" id json
+  local config="$1" title="ssh_host#$1" id private_key public_key
   id="$(resolve_item "$title")"
   if [ -z "$id" ]; then
     echo ">> $title: not in vault — skipping"
     return
   fi
   echo ">> $title: restoring"
-  json="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" --output json)"
-  private_key="$(jq -r '.item.content.content.SshKey.private_key' <<< "$json")"
-  public_key="$(jq  -r '.item.content.content.SshKey.public_key'  <<< "$json")"
-  [ -n "$private_key" ] || die "$title: private_key missing from vault item JSON"
-  [ -n "$public_key"  ] || die "$title: public_key missing from vault item JSON"
+  private_key="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
+    --field private_key --output human 2>/dev/null)"
+  public_key="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
+    --field public_key --output human 2>/dev/null)"
+  [ -n "$private_key" ] || die "$title: private_key field missing or empty in vault item"
+  [ -n "$public_key"  ] || die "$title: public_key field missing or empty in vault item"
   mkdir -p "$KEYDIR/$config"
   printf '%s' "$private_key" > "$KEYDIR/$config/ssh_host_ed25519_key"
   chmod 600 "$KEYDIR/$config/ssh_host_ed25519_key"
@@ -130,7 +130,7 @@ restore_age_key() {
   fi
   echo ">> $title: restoring"
   content="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
-    --output json | jq -r '.item.content.note')"
+    --field note --output human 2>/dev/null)"
   [ -n "$content" ] || die "$title: note field is empty in vault item"
   mkdir -p "$(dirname "$dest")"
   printf '%s\n' "$content" > "$dest"