Switch desktop environment from Hyprland to Budgie; app/audio overhaul

Hyprland problems prompted a full switch to Budgie (X11, lightdm).
Removes every Hyprland/Quickshell dotfile, theming script, and
hypr-specific module (theme.nix, the whole scripts/ theming pipeline,
hyprland.conf/hyprpaper.conf, the Quickshell shell QML, kitty/mako/
rofi configs) in favor of Budgie's own panel/session/theming and a
GSettings-driven icon/cursor override.

App changes:
- Konsole/Dolphin replace kitty/Thunar as the default terminal and
  file manager; dropped xterm too (services.xserver.excludePackages)
- Added Okular (PDF/document viewer), KCalc (calculator), Elisa
  (audio player) -- nothing filled those roles before
- Added OBS Studio

Audio/voice:
- EasyEffects for real-time mic/output effects (creates its own
  selectable "Easy Effects Source" virtual mic automatically)
- A standalone "Virtual Microphone" PipeWire device (loopback module,
  services.pipewire.extraConfig), fully independent of the real mic,
  for routing EasyEffects/Soundux output separately from what Discord
  etc. use by default
- qpwgraph for manual patchbay routing into the above
- Soundux (soundboard) installed via Flatpak -- no longer packaged in
  this nixpkgs channel

default-apps.nix: Okular wired into mimeapps.list alongside the
existing Gwenview/Ark defaults; removed the Thunar-specific
"Open Terminal Here" custom-action tmpfiles rule (dead now that
Thunar's gone -- Dolphin gets the same via its built-in konsolepart
terminal panel for free).

modules/system.nix

@@ -58,6 +58,36 @@
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
+
+    # Standalone "Virtual Microphone" device, fully independent of the real
+    # hardware mic — always present regardless of what's running, so apps
+    # like Discord keep defaulting to the real mic untouched, and only pick
+    # this up if explicitly selected. Feed anything into "Virtual
+    # Microphone Sink" (e.g. via qpwgraph/helvum, routing EasyEffects' or
+    # Soundux's output to it) and it comes out the other side as "Virtual
+    # Microphone", selectable like any other input device.
+    extraConfig.pipewire."99-virtual-microphone" = {
+      "context.modules" = [
+        {
+          name = "libpipewire-module-loopback";
+          args = {
+            "node.description" = "Virtual Microphone";
+            "capture.props" = {
+              "node.name" = "virtual_mic_sink";
+              "node.description" = "Virtual Microphone Sink";
+              "media.class" = "Audio/Sink";
+              "audio.position" = "FL,FR";
+            };
+            "playback.props" = {
+              "node.name" = "virtual_mic_source";
+              "node.description" = "Virtual Microphone";
+              "media.class" = "Audio/Source";
+              "audio.position" = "FL,FR";
+            };
+          };
+        }
+      ];
+    };
   };
 
   hardware.bluetooth = {
@@ -168,6 +198,15 @@
     "net.ipv6.conf.default.accept_redirects" = false;
     "net.ipv4.conf.all.send_redirects" = false;
     "net.ipv4.conf.default.send_redirects" = false;
+    # Restrict ptrace to a process's own children — blocks a common local
+    # credential-scraping/process-injection vector between unrelated
+    # processes. Only bites ad-hoc `gdb -p <pid>`-style attaches to a
+    # process that isn't your debugger's own child.
+    "kernel.yama.ptrace_scope" = 1;
+    # Drop the kernel-uptime-derived TCP timestamp from outgoing packets
+    # (a passive fingerprinting/uptime-leak vector). Negligible throughput
+    # impact on a normal home connection.
+    "net.ipv4.tcp_timestamps" = 0;
   };
 
   # Crash dumps can contain decrypted memory contents, passwords, keys —
@@ -201,4 +240,16 @@
   networking.networkmanager.wifi.macAddress = "random";
   networking.networkmanager.wifi.scanRandMacAddress = true;
   networking.networkmanager.ethernet.macAddress = "stable";
+
+  # Disable NetworkManager's periodic external connectivity probe (normally
+  # pings a canary URL to detect captive portals) — one less routine
+  # external phone-home, no functional loss on a directly-connected desktop.
+  networking.networkmanager.settings.connectivity = {
+    uri = "";
+    interval = 0;
+  };
+
+  # Budgie's module turns this on by default (for Budgie Control Center's
+  # Location Services panel) — nothing in this config needs location data.
+  services.geoclue2.enable = false;
 }