Bring laptop in line with desktop config: Plasma 6, Limine, module split

The laptop was still on the Hyprland-era Pantheon commit while the desktop
moved to KDE Plasma 6 + Limine and split system.nix into focused modules.
This brings over everything that isn't hardware, unchanged, so both machines
stay diffable:

- Plasma 6 on Wayland with SDDM, Konsole, gruvbox icons, KDE MIME defaults
  (replaces Pantheon/LightDM; libreoffice-qt6 replaces the GTK build)
- Limine bootloader with the gruvbox theme, replacing systemd-boot
- system.nix split into boot/networking/locale/nix-settings/security
- flakes + nix-command, sysctl hardening extras (yama, tcp_timestamps),
  geoclue off, captive-portal probe off
- package parity: obs-studio, lmms, go, qemu, KDE utilities, lean SDR++ and
  rtl_433 overrides with hardware.rtl-sdr

Hardware and power are adapted rather than copied:

- hardware.nix keeps the AMD 680M + RTX 4050 PRIME offload setup, asusd and
  supergfxd, v4l2loopback webcam and the DualSense ERTM fix; OpenRGB and
  the desktop's single-GPU block are dropped, keyboard lighting is asusctl
- power.nix is new: power-profiles-daemon for Plasma's profile switcher,
  lid-close handling via the current logind.settings.Login spelling,
  powertop/acpi, notes on asusctl charge limits
- no acpi_enforce_resources=lax, ACPI owns the EC asusd drives here
- touchpad defaults, and firewall openings so the hotspot script's shared
  connection can hand out DHCP/DNS
- pinentry-qt instead of the desktop's leftover pinentry-rofi, blueman
  dropped in favour of Plasma's bluedevil

hardware-configuration.nix stays tracked here (unlike the desktop, which
gitignores it) since it's the only record of this machine's disk layout.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

modules/desktop.nix

@@ -1,38 +1,74 @@
 { config, pkgs, ... }:
 
 {
-  # --- Pantheon: elementary OS's desktop environment (gala compositor, Wayland) ---
-  # Pulls in its own session (pantheon-wayland), top panel (Wingpanel), dock,
-  # app launcher, Files, Terminal, Screenshot, Photos, notifications, and
-  # GTK/icon theming — no separate compositor config or dotfile symlinking
-  # needed, unlike the previous Hyprland setup.
+  # Plasma ships a proper Wayland session (KWin) with solid Xwayland
+  # support; xserver stays on for that Xwayland layer and for the xkb
+  # layout below, not because the session itself needs it.
   services.xserver.enable = true;
-  services.xserver.displayManager.lightdm.enable = true;
-  services.desktopManager.pantheon.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+  # SDDM is KDE's own greeter — Qt-based, and launches Wayland sessions
+  # natively, Plasma included.
+  services.displayManager.sddm = {
+    enable = true;
+    wayland.enable = true;
+  };
 
-  # Keyboard layout for LightDM/XWayland; Pantheon's own session picks this
-  # up too.
   services.xserver.xkb = {
     layout = "pl";
     variant = "";
   };
 
-  security.polkit.enable = true;
+  services.tumbler.enable = true;
+  services.gvfs.enable = true;
 
-  # Native Wayland backend for Electron/Chromium-based apps
+  # xserver.nix installs xterm unconditionally; Konsole is the terminal here.
+  services.xserver.excludePackages = [ pkgs.xterm ];
+
+  # Native Wayland backend for the Electron/Chromium apps (vesktop, chromium,
+  # lmstudio) instead of letting them fall back to Xwayland.
   environment.sessionVariables.NIXOS_OZONE_WL = "1";
 
-  # Comfortable trackpad defaults for a laptop — tap-to-click and natural
-  # scrolling aren't on by default, and gala reads touchpad settings from
-  # GSettings at runtime (not services.libinput, which is X11-only), so
-  # they're set here as a dconf default instead.
-  programs.dconf.profiles.user.databases = [
-    {
-      settings."org/gnome/desktop/peripherals/touchpad" = {
-        tap-to-click = true;
-        natural-scroll = true;
-        two-finger-scrolling-enabled = true;
-      };
-    }
+  # Laptop trackpad. This writes an Xorg/libinput snippet, so it covers
+  # Xwayland and any X11 session — KWin's own Wayland session keeps touchpad
+  # settings per-device in ~/.config/kcminputrc instead (System Settings →
+  # Mouse & Touchpad), and those keys are keyed by the device's VID/PID, so
+  # they can't be pinned down from another machine. Set them once there, or
+  # bring in plasma-manager if you want them declarative too.
+  services.libinput.enable = true;
+  services.libinput.touchpad = {
+    tapping = true;
+    naturalScrolling = true;
+    disableWhileTyping = true;
+  };
+
+  # Hybrid graphics: KWin normally picks the right GPU on its own, but if a
+  # session ever comes up rendering on the RTX 4050 (hot, loud, worse battery)
+  # pin it to the AMD iGPU — bus 35:00.0 from `lspci`. Verify the path exists
+  # before enabling, an invalid device makes KWin fail to start:
+  #   ls /dev/dri/by-path/
+  # environment.sessionVariables.KWIN_DRM_DEVICES =
+  #   "/dev/dri/by-path/pci-0000:35:00.0-card";
+
+  # Icon/cursor theme packages. Plasma has no gsettings-style declarative
+  # knob for this the way Pantheon did — pick them in System Settings, or
+  # bring in plasma-manager later for a fully declarative setup.
+  environment.systemPackages = [
+    pkgs.gruvbox-plus-icons
+    pkgs.bibata-cursors
+  ];
+
+  fonts.packages = with pkgs; [
+    corefonts
+    dejavu_fonts
+    noto-fonts
+    noto-fonts-cjk-sans
+    noto-fonts-color-emoji
+    nerd-fonts.fira-code
+    nerd-fonts.jetbrains-mono
+    nerd-fonts.hack
+    inter
+    liberation_ttf
+    roboto
   ];
 }