Bring laptop in line with desktop config: Plasma 6, Limine, module split

The laptop was still on the Hyprland-era Pantheon commit while the desktop
moved to KDE Plasma 6 + Limine and split system.nix into focused modules.
This brings over everything that isn't hardware, unchanged, so both machines
stay diffable:

- Plasma 6 on Wayland with SDDM, Konsole, gruvbox icons, KDE MIME defaults
  (replaces Pantheon/LightDM; libreoffice-qt6 replaces the GTK build)
- Limine bootloader with the gruvbox theme, replacing systemd-boot
- system.nix split into boot/networking/locale/nix-settings/security
- flakes + nix-command, sysctl hardening extras (yama, tcp_timestamps),
  geoclue off, captive-portal probe off
- package parity: obs-studio, lmms, go, qemu, KDE utilities, lean SDR++ and
  rtl_433 overrides with hardware.rtl-sdr

Hardware and power are adapted rather than copied:

- hardware.nix keeps the AMD 680M + RTX 4050 PRIME offload setup, asusd and
  supergfxd, v4l2loopback webcam and the DualSense ERTM fix; OpenRGB and
  the desktop's single-GPU block are dropped, keyboard lighting is asusctl
- power.nix is new: power-profiles-daemon for Plasma's profile switcher,
  lid-close handling via the current logind.settings.Login spelling,
  powertop/acpi, notes on asusctl charge limits
- no acpi_enforce_resources=lax, ACPI owns the EC asusd drives here
- touchpad defaults, and firewall openings so the hotspot script's shared
  connection can hand out DHCP/DNS
- pinentry-qt instead of the desktop's leftover pinentry-rofi, blueman
  dropped in favour of Plasma's bluedevil

hardware-configuration.nix stays tracked here (unlike the desktop, which
gitignores it) since it's the only record of this machine's disk layout.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

modules/security.nix

@@ -0,0 +1,40 @@
+{ config, pkgs, ... }:
+
+{
+  security.polkit.enable = true;
+
+  security.sudo.extraConfig = ''
+    Defaults pwfeedback
+  '';
+
+  programs.firejail.enable = true;
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    # Qt pinentry to match Plasma (the desktop still says pinentry-rofi, a
+    # leftover from its Hyprland days — rofi isn't even installed there).
+    pinentryPackage = pkgs.pinentry-qt;
+  };
+
+  boot.kernel.sysctl = {
+    "kernel.kptr_restrict" = 2;
+    "kernel.dmesg_restrict" = 1;
+    "net.ipv4.conf.all.rp_filter" = 1;
+    "net.ipv4.conf.default.rp_filter" = 1;
+    "net.ipv4.conf.all.accept_redirects" = false;
+    "net.ipv4.conf.default.accept_redirects" = false;
+    "net.ipv6.conf.all.accept_redirects" = false;
+    "net.ipv6.conf.default.accept_redirects" = false;
+    "net.ipv4.conf.all.send_redirects" = false;
+    "net.ipv4.conf.default.send_redirects" = false;
+    # Only bites ad-hoc `gdb -p <pid>` on a non-child process.
+    "kernel.yama.ptrace_scope" = 1;
+    "net.ipv4.tcp_timestamps" = 0;
+  };
+
+  systemd.coredump.enable = false;
+  security.protectKernelImage = true;
+
+  services.geoclue2.enable = false;
+}