Uses self-contained pactl/ffmpeg commands so completions work without
record being in PATH (e.g. when completing through `s record <TAB>`).

Add virtual.All mailbox (all messages across all folders) so attachments
can be opened reliably (virtual.Unread loses messages when marked read).
Bump imapMemoryLimit to 1GB for virtual mailbox sync.
Also increase snappymail PHP/nginx timeouts.

Move virtual mailbox config from nix store (read-only) to
/var/vmail/virtual-config via systemd.tmpfiles, fixing ACL plugin
errors. Exclude notmuch and fts-flatcurve from virtual search.

Adds a deploy wrapper around `clan machines update` that:
- Syncs the password store (pull/push) around deploys
- Extracts the bulk age key into a secure tmpdir for fast decryption
- Cleans up key material on exit

Co-Authored-By: Claude (claude-opus-4-6) <noreply@anthropic.com>