Bring over the PC config's changes: NexoPass, AppImages, Firefox privacy

- nexopass and nexopass-gui (scripts.nix, with the wordlist and icon)
- AppImages run directly through appimage-run's binfmt (apps.nix)
- Firefox: full fingerprinting protection except forced light mode,
  Accept-Language en-US, and its own font list without corefonts
- README updated to match

Left out as PC-only: OpenRGB, acpi_enforce_resources=lax, the
Vega 8/RTX 3060 Ti graphics setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/apps.nix

@@ -122,4 +122,9 @@ in
     libxrandr libxcursor libxcb libxkbcommon
     alsa-lib mesa zlib stdenv.cc.cc
   ];
+
+  # Registers AppImages with binfmt_misc, so ./Foo.AppImage (or a double-click
+  # in Dolphin) runs straight through appimage-run's FHS environment.
+  programs.appimage.enable = true;
+  programs.appimage.binfmt = true;
 }