terra: cosmic portals, jupiter smb mount, tea CLI, launcher/theme polish

- swap gtk portal/apps for cosmic (xdg-desktop-portal-cosmic, cosmic-files,
  cosmic-settings) and drop dolphin/protonplus/bambu-studio (bambu-studio
  moved to flatpak alongside the other comms/gaming flatpaks)
- mount jupiter's samba share at /mnt/jupiter (automount, credentials from
  the same samba_password secret jupiter itself uses)
- add tea (gitea's remote API CLI) for talking to git.mgaction.town from
  terra without SSHing into jupiter
- new dark icon themes (Amy, Azure Glassy, Slot Beauty) vendored from
  gnome-look.org tarballs, packaged since pling download links expire
- rishot: fix Qt5Compat.GraphicalEffects QML import (was missing qt6.qt5compat
  on QML_IMPORT_PATH, so quickshell failed at config-load)
- launcher widgets: stop LauncherConsole/LauncherDock from reserving
  compositor space (ExclusionMode.Ignore, they're overlays not real docks);
  bump LauncherCorner app icon size 28->34
- comms script: launch telegram/discord via flatpak, not native binaries
- nix-ld + boot.binfmt aarch64 emulation (for building/flashing mercury
  from terra)

pkgs/azure-glassy-dark-icons.nix

@@ -0,0 +1,48 @@
+{ lib, stdenvNoCC, gtk3 }:
+
+# Azure-Glassy-Dark-Icons (gnome-look.org/p/2154036), not packaged in
+# nixpkgs. gnome-look/pling download links are signed JWTs that expire in
+# ~2 days (`exp` claim on the URL was ~48h out from issuance) — fetchurl
+# against one would work today and fail on the next rebuild after that
+# window with no warning. The tarball is vendored into the repo instead, as
+# verified (md5 d218b358086ee7f68cb5e98c53e9efaf against the gnome-look API's
+# reported checksum) at dotfiles/icons/Azure-Glassy-Dark-Icons.tar.xz.
+stdenvNoCC.mkDerivation {
+  pname = "azure-glassy-dark-icons";
+  version = "unstable-2026-07-12";
+
+  src = ../dotfiles/icons/Azure-Glassy-Dark-Icons.tar.xz;
+
+  nativeBuildInputs = [ gtk3 ];
+
+  dontBuild = true;
+
+  # Upstream ships a handful of dangling symlinks under mimetypes/16 (e.g.
+  # libreoffice-spreadsheet.svg -> libreoffice-oasis-spreadsheet.svg, which
+  # doesn't exist in that size dir) — a minor packaging bug in the theme
+  # itself. Harmless: GTK's icon lookup just falls through to the theme's
+  # own Inherits= chain (breeze-dark, breeze, Adwaita, hicolor) for those few
+  # mimetypes. Nixpkgs' default noBrokenSymlinks fixup check would otherwise
+  # fail the whole build over it.
+  dontCheckForBrokenSymlinks = true;
+
+  # gtk3's setup hook strips icon-theme.cache from $out by default
+  # (postFixup); papirus-icon-theme opts back out the same way rather than
+  # let the freshly regenerated cache get thrown away.
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/icons"
+    cp -r . "$out/share/icons/Azure-Glassy-Dark-Icons"
+    gtk-update-icon-cache --force "$out/share/icons/Azure-Glassy-Dark-Icons"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Azure-Glassy dark icon theme, vendored from gnome-look.org (not packaged in nixpkgs)";
+    homepage = "https://www.gnome-look.org/p/2154036";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+}