terra: cosmic portals, jupiter smb mount, tea CLI, launcher/theme polish

- swap gtk portal/apps for cosmic (xdg-desktop-portal-cosmic, cosmic-files,
  cosmic-settings) and drop dolphin/protonplus/bambu-studio (bambu-studio
  moved to flatpak alongside the other comms/gaming flatpaks)
- mount jupiter's samba share at /mnt/jupiter (automount, credentials from
  the same samba_password secret jupiter itself uses)
- add tea (gitea's remote API CLI) for talking to git.mgaction.town from
  terra without SSHing into jupiter
- new dark icon themes (Amy, Azure Glassy, Slot Beauty) vendored from
  gnome-look.org tarballs, packaged since pling download links expire
- rishot: fix Qt5Compat.GraphicalEffects QML import (was missing qt6.qt5compat
  on QML_IMPORT_PATH, so quickshell failed at config-load)
- launcher widgets: stop LauncherConsole/LauncherDock from reserving
  compositor space (ExclusionMode.Ignore, they're overlays not real docks);
  bump LauncherCorner app icon size 28->34
- comms script: launch telegram/discord via flatpak, not native binaries
- nix-ld + boot.binfmt aarch64 emulation (for building/flashing mercury
  from terra)

secrets/terra.yaml

@@ -1,5 +1,6 @@
 tailscale_authkey: ENC[AES256_GCM,data:DgxbMrKTxC//cWd+ZckCbwZ9j/FgjYwNwadU5cWnnPz+nPEFhXLla2TuUE0pJKpcx9pKZCQmxcGtzQvIB+mbgxjgB0X2CRTp4Yy3WR+PBYMghKx36F8KBg==,iv:hJr6O41OTdMa4wkBXEsRUXgV4zWt21h1kx/CWArLU7o=,tag:IEpMIwKBHakvVYEFdEUe7A==,type:str]
 darman_password: ENC[AES256_GCM,data:G3ZM+NMxvKq5twblcBvyC+MiUX+X7nz+s1GqBHBkJQy1YgW4KN6rpbdj10F9jWxHph5dJ9j9fG6L7UlEg5W5zUYeLFdEx2xJGE1fxksch+6BB9FT6LKkhJ7MmbJmhNHYwJOZO3LM1f/oRw==,iv:abQTRe9kRyYj+TL0rtoxM6JFBaIBmxu7y77qt1h4eME=,tag:OgKrB3SUgSNJjmtJyrmh/Q==,type:str]
+samba_password: ENC[AES256_GCM,data:UkJLUa2hW1iZ++sfJAcg6G1RJMM=,iv:/HbZ9F+GxCydUP50PNBtJknPlmDWh1DAE26N9FJUyb0=,tag:z1cbwUaVdyfwEIU8LINEcw==,type:str]
 sops:
     age:
         - enc: |
@@ -20,7 +21,7 @@ sops:
             sHjKfw8VrrmAR4pQf1dsY+wcyh4FsZxhP3Q+QIVq3eCIXS9PeJkGAg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
-    lastmodified: "2026-07-24T23:30:39Z"
-    mac: ENC[AES256_GCM,data:JaBDewUFFEiGnigXsUjAaIEiz1FI6N17pMQT/7qBpA6rtrUoatzjEkl2rpENXuSh0cGI2p328u8tvqDkgel7pGFLY+fYuYgOv6tOSbCgeZM939FrT1P3T4evTcyCUDyAS0NFYEvge83zjW6mula0HY2AsKN1PHaj4XeKLETNvH8=,iv:pBct6RALFuYRUe2EqCSpUPxJ9/7dMt4O2VMZUUjrJks=,tag:UsGTnEbQzp1v8pVb0j2itw==,type:str]
+    lastmodified: "2026-07-28T20:18:44Z"
+    mac: ENC[AES256_GCM,data:TRh/Idd8MEq/5QRb7r+g6msdaObtVzsX5hK5gacJI6seZ5BLW5tcBO/E2m8ya4t50lTofxkwObWskMbCOucLDYt+lnYwHSqDvAeQRvswxaCZgiFOn0upqCi8H4OomvIK475SIH6bniyN9bCQ2gaSS0D9aecyCSmdUARkmcZEYLc=,iv:PBoEUZG0QNyj4B0c6zuWr6Y39EdL1CoAsVExU86P6Tw=,tag:NPxsWkxdojXNsoxVVMb5TQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2