age-plugin-gpg lets a gpg key (via gpg-agent + keygrip) act as an age
recipient/identity, so adding the corresponding age1gpg1... line to
.age-recipients makes every passage secret encryptable to gpg as well.
Caveat: gpg keygrips end up as plaintext in the encrypted file.

Newer nixpkgs renders 'settings.enable-ssh-support = true' as
'enable-ssh-support true', which gpg-agent rejects with 'argument not
expected' since it's a boolean flag. Use "" instead so the keyValue
formatter emits a bare 'enable-ssh-support ' line gpg-agent accepts.

Existing preHook only dumped matrix-synapse; the per-bridge postgres
DBs (mautrix-{whatsapp,signal,telegram,discord}) and heisenbridge's
sqlite state weren't covered. Losing them = relogin everywhere and
orphaned portal rooms.

Used via nixpkgs.overlays so per-module insecure-package permits compose
cleanly — nixpkgs.config.permittedInsecurePackages merges via
recursiveUpdate, so list values from multiple modules clobber each other.
Switch jitsi over as the first consumer.