Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all),
listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd
behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion
preferred seeds. Move the config off xerxes onto neoprism, and put the node
state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in
byte quota; the dataset bounds it).

Reference pinentry-rofi (or pinentry_mac on darwin) directly in the
wrapper and write it to rbw config before unlocking, instead of relying
on a persisted store path that gets garbage-collected and breaks
'rbw unlock' with 'error spawning pinentry: No such file'.