nixos-unstable has omp 18.11.0, whose fetchFromGitHub hash no longer
matches the tarball GitHub serves (Hydra rejects the output as well), so
coaxmetal, neoprism and barnacle fail to build. Pin the version from
nixpkgs master (18.11.2: new src and cargoDeps hashes, node_modules hash
unchanged) as an override of nixpkgs' omp. The assert breaks evaluation
as soon as nixpkgs moves away from 18.11.0, so the pin gets dropped with
the next flake update that brings a fixed omp.

We don't use the Matrix-Zulip bridge anymore, and its dependency python3.14-zulip-emoji-mapping fails to build with the current nixpkgs, which blocks the flake update.

Zitadel asks every user with an unverified address (registration, all
byoidc logins) for a code before the login finishes. Without an SMTP
provider the code was never sent (Errors.SMTPConfig.NotFound) and these
users were stuck. They now come from the send-only account id@lassul.us
on the mailserver, over TLS on mail.lassul.us:465.

lass.zitadel.smtp creates, updates and activates the instance's SMTP
provider. Zitadel 2.71 skips providers without a password, so the
password comes from passwordFile; a hash of the one Zitadel has is kept
in the state directory to update it when the file changes.