Add virtual.All mailbox (all messages across all folders) so attachments
can be opened reliably (virtual.Unread loses messages when marked read).
Bump imapMemoryLimit to 1GB for virtual mailbox sync.
Also increase snappymail PHP/nginx timeouts.

Move virtual mailbox config from nix store (read-only) to
/var/vmail/virtual-config via systemd.tmpfiles, fixing ACL plugin
errors. Exclude notmuch and fts-flatcurve from virtual search.

Adds a deploy wrapper around `clan machines update` that:
- Syncs the password store (pull/push) around deploys
- Extracts the bulk age key into a secure tmpdir for fast decryption
- Cleans up key material on exit

Co-Authored-By: Claude (claude-opus-4-6) <noreply@anthropic.com>

Add usage.kdl (https://usage.jdx.dev/spec/) files for all 32 tools
describing their CLI interface. Each tool exposes its spec as a string
via passthru.usage (builtins.readFile ./usage.kdl).

The s wrapper now includes a zsh completion function that:
- Instantly completes package names (baked in at build time)
- Lazily fetches per-tool usage specs via nix eval on first use
- Caches specs keyed by flake narHash for invalidation

- systemd service running as dedicated kanban user on SSD (zroot)
- nginx reverse proxy at kanban.lassul.us with basic auth via clan vars
- DNS record for kanban.lassul.us
- binary-patch claude-code version for claude 4.6 support
- backup of vibe-kanban state

nixos-mailserver mkForces the virtualMail user without homeMode,
causing NixOS activation to reset /var/vmail to 0700 on every deploy.
Override at the same priority to set homeMode=2770, replacing the
chmod workaround in ExecStartPost.

SnappyMail PHP webmail served via nginx + php-fpm.
Data stored in /var/lib/snappymail.
Admin panel at mail.lassul.us/?admin after first deploy.

- Enable posixacl on zroot ZFS pool for /var/vmail
- Set POSIX ACL default granting lass rwX on mail dir (new files inherit)
- Fix /var/vmail permissions after dovecot pre-start resets to 0700
- Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs
- Change recursive tmpfiles rule to non-recursive to avoid setgid on files

- Add autoconfig XML endpoint on autoconfig.lassul.us via nginx
- Add DNS SRV records for IMAPS and SMTP submission (RFC 6186)
- Fix vmail tmpfiles rules to use 2770 to match dovecot pre-start

mutt:
- Fix notmuch folder queries to use Maildir++ dot prefix
- INBOX opens by default via explicit notmuch spoolfile
- Unread shows all unread across all folders
- Archive (A) tags messages, hidden from INBOX on sync
- Show mailbox counts in sidebar at startup
- Set mbox_type=Maildir, auto-confirm append/create/delete

muchsync:
- Move archived messages from INBOX to archive folder before sync

Enable mail_check_stats so sidebar shows counts without opening
each mailbox first. Change archive (A) to move messages to an
archive folder on disk instead of just tagging.

notmuch indexes Maildir++ folders with the dot prefix, so queries
need folder:.to.steam not folder:to.steam. INBOX is the root
maildir, queried as folder:"".

Use tmpfiles z/Z rules to set group permissions on /var/vmail
so the virtualMail group (which lass is in) can access mail
directories for muchsync/notmuch.

Symlink ~lass/Maildir to vmail, add lass to virtualMail group,
install notmuch + muchsync for remote sync.

- notmuch: remove hardcoded mailboxes, use folder: queries instead of tags
- mutt: auto-discover sieve folders from Maildir at startup
- muchsync: connect to neoprism.lassul.us:45621 instead of green

- Remove declarative sieveScript, manage rules dynamically via ManageSieve (port 4190)
- Replace krebs.iptables with networking.firewall.allowedTCPPorts
- Add /var/sieve to borg backup paths

IMAPS, SMTP submission, sieve filtering, DKIM, full-text search.
Remove dead code internet-gateway.nix and hackerfleet exim router.
Add mail and DKIM dirs to borg backup.

Use `nix build --print-out-paths` + PYTHONPATH instead of `nix shell`
for the websocket-client bootstrap. Caches the store path in /tmp.
Goes from 30s+ to under 1s.

- Disable spurious PCIe wakeup sources via udev rule
- Add 64GB swapfile and resume config for hibernation
- Enable suspend-then-hibernate (15min s2idle, then hibernate)
- Load amdgpu in initrd for reliable resume
- Add amdgpu.gpu_recovery=1 kernel param
- Pre-evict VRAM before sleep via systemd service

- Switch flake input to github:Lassulus/opencrow/tool_n_stop
- Enable OPENCROW_SHOW_TOOL_CALLS to relay tool calls to Matrix chat
- !stop command aborts running agent turns mid-execution

Replace GTK :tooltip property with custom hover-tip widget using
eventbox onhover/onhoverlost and in-bar overlay revealer, since GTK
native tooltip popups don't work on layer-shell surfaces.