The kiosk account owns everything needed to test a game the way a player
meets it, and none of it is reachable from outside: sway holds seat0,
XDG_RUNTIME_DIR is 0700, the Xbox pad's evdev nodes are ACL'd to strom
(only the legacy js0 is world-readable, and SDL2 does not use it), and
/home/strom carries both the game state and the /home/strom/strom
checkout that strom-session resolves STROM_FLAKE from.

Follows the existing 2configs/{wine,review,ableton}.nix pattern.

Without an admin nobody can manage any session: sessions registered
through the keyless announce API carry no owner, so canManage was false
for every one of them and the dashboard suppressed its share and kill
controls entirely.

invidious plus invidious-companion, with every request to YouTube going
out through the residential exits on styx (primary) and coaxmetal
(backup). An nginx stream block fans 127.0.0.1:8118 into the two
tinyproxies; failover rather than round-robin, because YouTube binds
po_tokens and videoplayback URLs to the requesting address.

The companion key is generated once into a clan var and handed to
invidious as a systemd credential (the config script runs as the
DynamicUser, which cannot read /run/secrets) and to the container as an
EnvironmentFile.

default_user_preferences.local is forced on: upstream defaults it off,
which makes invidious hand the browser raw googlevideo URLs that are
minted for the exit's address, so they 403 for the client and leak the
exit IP. Playback paths additionally require a real session via
auth_request, since the bytes come off a residential line.

invidious is pinned one release ahead of our nixpkgs for the comments
parser fix; drop the override once the pin catches up.

Livestreams do not play: YouTube serves them SABR-only or with HLS
segments that 403 without a po_token, and invidious' HLS path bypasses
companion. Upstream gap, tracked in iv-org/invidious#3811 and
iv-org/invidious-companion#7.

YouTube throttles and blocks Hetzner ranges, so neoprism cannot talk to
it directly. tinyproxy listens on the retiolum address of each box and
only accepts neoprism, giving invidious a residential exit.