Run an n2n v3 supernode and point n2n.lassul.us at neoprism.

- Listens on UDP 7654 (main n2n protocol) and TCP 7654 (aux listener used
by edges started with -S2 when their network blocks UDP); both opened in
the firewall.
- Starts as root: the supernode unconditionally drops privileges to nobody
(uid/gid 65534) and aborts if the setuid() fails, so DynamicUser does not
work. It ends up running as uid 65534 with the remaining hardening.
- Sets the federation name with -F krebs (n2n prepends '*', yielding the
federation community '*krebs') to avoid the default '*Federation', which
n2n warns is for testing only. This only scopes supernode-to-supernode
federation, not the community (-c) edges use.

Assisted-by: Claude Code (claude-opus-4-8[1m])

Firefox started from the systemd user manager (firefox.service) only got
DISPLAY but not XDG_SESSION_TYPE. With DISPLAY set and XDG_SESSION_TYPE
unset, its WebRTC capturer takes the X11/XWayland screencast path, which
captures a black screen under sway. Exporting XDG_SESSION_TYPE=wayland
makes it use the PipeWire portal instead, fixing screen sharing.

Assisted-by: Claude Code (claude-opus-4-8[1m])

The hardcoded `export SWAYSOCK=/run/user/$(id -u)/sway-ipc.sock` in
extraSessionCommands is ignored by sway >=1.11, which creates its own per-pid
socket (sway-ipc.$uid.$pid.sock). The dead path got baked into the firefox and
workspace-manager user services, so every swaymsg call failed and the extension
silently skipped tab restore on each workspace switch. Drop the export and let
the existing import-environment propagate the real socket sway advertises.

Also:
- workspace-menu: "Restore tabs" used pkgs.firefox (upstream stable) instead of
the wrapped Dev Edition daemon, launching a separate browser/profile
- workspace-tabs: never overwrite a saved workspace with an empty tab list, so
the transient blank window after a Firefox restart can't wipe real tabs

Assisted-by: Claude Code (claude-opus-4-8[1m])

It's too close to shift+insert (paste) and the default reset binding
scrambles running programs on accidental presses.

Assisted-by: Claude Code (claude-opus-4-8[1m])

mumble-reminder: add 26.05 Release Animal Yarara

- firefox.service: restartIfChanged/stopIfChanged = false so nixos-rebuild
switch no longer kills all open browser windows
- xdg-desktop-portal-wlr: retry until system-wide pipewire is reachable
(RestartSec=2, startLimitIntervalSec=0) instead of tripping the start-limit
at boot and staying dead, which silently broke screensharing
- workspace-tabs: register the anchor-window scratchpad rule statically in the
sway config, only persist/restore http(s) URLs, and skip anchor-titled
windows in the sway mapping, so the anchor no longer leaks into workspace
files and reappears as a phantom window after a restart

Assisted-by: Claude Code (claude-opus-4-8[1m])