terra: cosmic portals, jupiter smb mount, tea CLI, launcher/theme polish

- swap gtk portal/apps for cosmic (xdg-desktop-portal-cosmic, cosmic-files,
  cosmic-settings) and drop dolphin/protonplus/bambu-studio (bambu-studio
  moved to flatpak alongside the other comms/gaming flatpaks)
- mount jupiter's samba share at /mnt/jupiter (automount, credentials from
  the same samba_password secret jupiter itself uses)
- add tea (gitea's remote API CLI) for talking to git.mgaction.town from
  terra without SSHing into jupiter
- new dark icon themes (Amy, Azure Glassy, Slot Beauty) vendored from
  gnome-look.org tarballs, packaged since pling download links expire
- rishot: fix Qt5Compat.GraphicalEffects QML import (was missing qt6.qt5compat
  on QML_IMPORT_PATH, so quickshell failed at config-load)
- launcher widgets: stop LauncherConsole/LauncherDock from reserving
  compositor space (ExclusionMode.Ignore, they're overlays not real docks);
  bump LauncherCorner app icon size 28->34
- comms script: launch telegram/discord via flatpak, not native binaries
- nix-ld + boot.binfmt aarch64 emulation (for building/flashing mercury
  from terra)

hosts/terra/configuration.nix

@@ -1,10 +1,6 @@
+# ---- TERRA ----
 { config, pkgs, lib, inputs, ... }:
 
-# terra — Ryzen 9 5900X / Radeon RX 6800 XT desktop (MSI MS-7A32). Replaces
-# CachyOS on the OS SSD (Kingston SA400, sdb). Dev-data disks (sdc ext4
-# /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) are kept out of disko and mounted here
-# as plain filesystems so they're never wiped. The leftover ntfs disks
-# (sda, sdf, nvme0n1) are ignored entirely — not referenced anywhere.
 let
   unstable = import inputs.nixpkgs-unstable {
     inherit (pkgs.stdenv.hostPlatform) system;
@@ -14,9 +10,9 @@ in
 {
   imports = [
     ./hardware-configuration.nix
-    ./disk-config.nix          # disko: OS-disk (sdb) partitions + filesystems
-    ./secrets.nix               # sops-nix: darman password, tailscale key
-    ../../common.nix               # shared base: user / ssh / nix / firewall
+    ./disk-config.nix
+    ./secrets.nix
+    ../../common.nix
     ../../services/vpn/tailscale.nix
     ../../services/desktop/desktop-hyprland.nix
     ../../services/desktop/desktop-apps.nix
@@ -28,21 +24,27 @@ in
     enable = true;
     remotes = [{ name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo"; }];
     packages = [
+      { appId = "com.github.tchx84.Flatseal"; origin = "flathub"; }
       { appId = "com.blitzfc.qbz";        origin = "flathub"; }
       { appId = "com.discordapp.Discord";  origin = "flathub"; }
       { appId = "org.telegram.desktop";   origin = "flathub"; }
+      { appId = "com.bambulab.BambuStudio"; origin = "flathub"; }
     ];
   };
 
-  # Proton Pass CLI — in nixpkgs-unstable (2.2.3+); scripts/deploy uses it to
-  # autofill sudo/ssh passwords from the "HomeLab" vault.
   environment.systemPackages = [ unstable.proton-pass-cli ];
 
+  # ---- nix-ld: lets generic dynamically-linked Linux binaries run as-is —
+  # needed for editor extensions (Zed/VSCode LSPs, debuggers, etc.) that
+  # download prebuilt binaries not built for NixOS. See
+  # https://nix.dev/permalink/stub-ld ----
+  programs.nix-ld.enable = true;
+
   # ---- home-manager (user-level config for darman) ----
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;
   home-manager.backupFileExtension = "hm-bak";
-  home-manager.extraSpecialArgs = { inherit unstable; };
+  home-manager.extraSpecialArgs = { inherit unstable inputs; };
   home-manager.users.darman = import ./home.nix;
 
   # ---- Boot (UEFI) ----
@@ -50,20 +52,17 @@ in
   boot.loader.efi.canTouchEfiVariables = true;
   hardware.cpu.amd.updateMicrocode = true;
 
+  # mercury (aarch64) is built/flashed from here. Without this, `nix build`
+  # for it dies with "platform mismatch" — no qemu binfmt handler registered
+  # and aarch64-linux missing from nix.settings.extra-platforms. This module
+  # sets up both (see CLAUDE.md's aarch64 gotcha).
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
   # ---- GPU (Radeon RX 6800 XT / Navi 21) ----
-  # amdgpu needs the redistributable navi21 firmware blobs to bind the card.
-  # Without them the module loads but never initialises the GPU: there's no
-  # DRM card for it, the display falls back to the 1024x768 EFI
-  # simple-framebuffer as "Unknown-1", and the real DP-2/HDMI-A-1 outputs
-  # never appear — so hyprland's monitor rules match nothing.
   hardware.enableRedistributableFirmware = true;
-  # Early KMS: bind amdgpu in the initrd so it drives the console + greeter
-  # from boot instead of handing over from simple-framebuffer later.
   boot.initrd.kernelModules = [ "amdgpu" ];
 
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
-  # UUIDs captured from the running CachyOS box; verify after install
-  # (`lsblk -o NAME,UUID,MOUNTPOINT`) in case disko/kernel enumerates differently.
   fileSystems."/mnt/hdd_01" = {
     device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4";
     fsType = "ext4";
@@ -75,5 +74,22 @@ in
     options = [ "nofail" ];
   };
 
+  # jupiter's samba share (services/network/samba.nix) — mounted on demand so
+  # terra doesn't stall boot/login when jupiter is off or unreachable.
+  fileSystems."/mnt/jupiter" = {
+    device = "//jupiter/data";
+    fsType = "cifs";
+    options = [
+      "credentials=${config.sops.templates."jupiter-smb.credentials".path}"
+      "uid=1000"
+      "gid=100"
+      "nofail"
+      "x-systemd.automount"
+      "x-systemd.idle-timeout=60"
+      "x-systemd.mount-timeout=10s"
+      "_netdev"
+    ];
+  };
+
   system.stateVersion = "26.05";
 }