Move virtual mailbox config from nix store (read-only) to
/var/vmail/virtual-config via systemd.tmpfiles, fixing ACL plugin
errors. Exclude notmuch and fts-flatcurve from virtual search.

Adds a deploy wrapper around `clan machines update` that:
- Syncs the password store (pull/push) around deploys
- Extracts the bulk age key into a secure tmpdir for fast decryption
- Cleans up key material on exit

Co-Authored-By: Claude (claude-opus-4-6) <noreply@anthropic.com>

Add usage.kdl (https://usage.jdx.dev/spec/) files for all 32 tools
describing their CLI interface. Each tool exposes its spec as a string
via passthru.usage (builtins.readFile ./usage.kdl).

The s wrapper now includes a zsh completion function that:
- Instantly completes package names (baked in at build time)
- Lazily fetches per-tool usage specs via nix eval on first use
- Caches specs keyed by flake narHash for invalidation

- systemd service running as dedicated kanban user on SSD (zroot)
- nginx reverse proxy at kanban.lassul.us with basic auth via clan vars
- DNS record for kanban.lassul.us
- binary-patch claude-code version for claude 4.6 support
- backup of vibe-kanban state

nixos-mailserver mkForces the virtualMail user without homeMode,
causing NixOS activation to reset /var/vmail to 0700 on every deploy.
Override at the same priority to set homeMode=2770, replacing the
chmod workaround in ExecStartPost.

SnappyMail PHP webmail served via nginx + php-fpm.
Data stored in /var/lib/snappymail.
Admin panel at mail.lassul.us/?admin after first deploy.

- Enable posixacl on zroot ZFS pool for /var/vmail
- Set POSIX ACL default granting lass rwX on mail dir (new files inherit)
- Fix /var/vmail permissions after dovecot pre-start resets to 0700
- Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs
- Change recursive tmpfiles rule to non-recursive to avoid setgid on files

- Add autoconfig XML endpoint on autoconfig.lassul.us via nginx
- Add DNS SRV records for IMAPS and SMTP submission (RFC 6186)
- Fix vmail tmpfiles rules to use 2770 to match dovecot pre-start

mutt:
- Fix notmuch folder queries to use Maildir++ dot prefix
- INBOX opens by default via explicit notmuch spoolfile
- Unread shows all unread across all folders
- Archive (A) tags messages, hidden from INBOX on sync
- Show mailbox counts in sidebar at startup
- Set mbox_type=Maildir, auto-confirm append/create/delete

muchsync:
- Move archived messages from INBOX to archive folder before sync

Enable mail_check_stats so sidebar shows counts without opening
each mailbox first. Change archive (A) to move messages to an
archive folder on disk instead of just tagging.

notmuch indexes Maildir++ folders with the dot prefix, so queries
need folder:.to.steam not folder:to.steam. INBOX is the root
maildir, queried as folder:"".

Use tmpfiles z/Z rules to set group permissions on /var/vmail
so the virtualMail group (which lass is in) can access mail
directories for muchsync/notmuch.

Symlink ~lass/Maildir to vmail, add lass to virtualMail group,
install notmuch + muchsync for remote sync.

- notmuch: remove hardcoded mailboxes, use folder: queries instead of tags
- mutt: auto-discover sieve folders from Maildir at startup
- muchsync: connect to neoprism.lassul.us:45621 instead of green

- Remove declarative sieveScript, manage rules dynamically via ManageSieve (port 4190)
- Replace krebs.iptables with networking.firewall.allowedTCPPorts
- Add /var/sieve to borg backup paths

IMAPS, SMTP submission, sieve filtering, DKIM, full-text search.
Remove dead code internet-gateway.nix and hackerfleet exim router.
Add mail and DKIM dirs to borg backup.

Use `nix build --print-out-paths` + PYTHONPATH instead of `nix shell`
for the websocket-client bootstrap. Caches the store path in /tmp.
Goes from 30s+ to under 1s.

- Disable spurious PCIe wakeup sources via udev rule
- Add 64GB swapfile and resume config for hibernation
- Enable suspend-then-hibernate (15min s2idle, then hibernate)
- Load amdgpu in initrd for reliable resume
- Add amdgpu.gpu_recovery=1 kernel param
- Pre-evict VRAM before sleep via systemd service

- Switch flake input to github:Lassulus/opencrow/tool_n_stop
- Enable OPENCROW_SHOW_TOOL_CALLS to relay tool calls to Matrix chat
- !stop command aborts running agent turns mid-execution

Replace GTK :tooltip property with custom hover-tip widget using
eventbox onhover/onhoverlost and in-bar overlay revealer, since GTK
native tooltip popups don't work on layer-shell surfaces.