Use the gomuks v0.2601.0 codebase (cmd/gomuks-terminal) instead of the
abandoned v0.3.1 TUI. This version uses mautrix with built-in goolm,
a pure-Go olm replacement, avoiding the insecure and deprecated libolm
C library entirely. E2EE works without CGO.

When SSHing into a machine with existing tmux sessions, show an fzf
picker instead of always creating a new session. The picker shows
session name, window count, creation time, and attach status.

- Preview pane shows the current content of each session (via capture-pane)
- DEL key kills the highlighted session and refreshes the list
- Selecting a session attaches to it
- Selecting '>>> new session <<<' or pressing ESC creates a new one
- Local terminals are unaffected, only triggers when SSH_CLIENT is set

Add SABnzbd as Usenet download client alongside Transmission for torrents.
Radarr and Sonarr can now use both download methods.

- Add transmission-gc timer to remove completed torrents after ratio >= 5.0
or age >= 30 days, deleting files to free disk space
- Enable ratio-limit and seed-queue in transmission settings
- Fix transmission-watcher to check service state before restarting,
preventing restart loops during startup

The session keyring (@s) wasn't persisting keys when accessed from
systemd user services. Switch to user keyring (@u) which is shared
across all processes for the same UID.

Fix "too many open files" error by setting LimitNOFILE=65536

- Python asyncio daemon subscribing to sway IPC events
- User configs in ~/workspaces/<name>.json for hooks and directories
- Declarative NixOS module with per-field config merging
- Shell hook for auto-cd in new terminals
- ruff/mypy checks integrated into package build

- Click power graph to cycle through low/normal/high profiles
- Tooltip shows current TDP and profile name
- Add sudoers rule for passwordless ryzenadj
- Use state file since ryzenadj -i doesn't work on Strix Point

Replaces the inline set_tdp script from aergia with a reusable tool
supporting low/normal/high presets and custom wattage with burst limits.

- use session keyring (@s) instead of user keyring (@u) for caching
- use keyctl padd instead of keyctl add to avoid PIN in /proc/*/cmdline
- make keyctl timeout failures non-fatal
- reject empty PIN input
- "Clear cache" falls through to re-prompt instead of aborting
- integrate with pass wrapper via maybe_set_tpm_pin
- apply same keyring and security fixes to tools.pinentry-rofi

Add -i flag for case-insensitive matching so typing 'o' filters to OK.
Remove -only-match and hidden inputbar which broke keyboard selection.

Switch from --netfilter to --iptables mode so Jool only processes
container traffic. --netfilter mode intercepts all packets to
64:ff9b::/96, breaking upstream NAT64 (e.g., Android hotspot tethering).

Show OK/Cancel/Clear cache options instead of confusing menu.
Add -only-match to prevent typing from breaking selection.

Uses NixOS services.radicle module with clan vars for key management.
Configures SOCKS proxy for .onion seed connectivity.

- Cache PIN in kernel keyring (keyctl) for 5 minutes with sliding window
- Show menu to use cached PIN or clear cache when cache exists
- Escape <, >, & in SSH args for pango markup (fixes empty prompt with
commands containing redirections like 2>/dev/null)