dpi-tunnel is now the default full tunnel. Keep the sing-box TUN for
manual use (systemctl start sing-box) instead of starting it at boot.
Assisted-by: Claude:opus-5-5
nixpkgs moves from 2026-10-17 to 2026-11-01. Also updated: nix-amd-ai
and sops-nix.
Fallout handled in the same commit so every revision builds:
- tlp-profile-switcher was dropped from nixpkgs (upstream declares only
GNOME 48) and aider-chat's posthog dependency is broken on Python
3.14; take both from the previous nixpkgs until they evaluate again.
- NSS 3.131.1 removed "emSign ECC Root CA - G3", and a blacklist entry
for a missing root fails the cacert build; drop it.
- A cached firefox-devedition is back in nixpkgs, so remove the
2026-07-05 pin.
Assisted-by: Claude:opus-5-5
Add opensc (PKCS#11) and pcsc-tools, enable pcscd, and add a udev rule
granting access to the built-in reader (2ce3:9563), which the shipped
CCID rules miss (pcscd hit LIBUSB_ERROR_ACCESS). Configure Firefox to
load the OpenSC PKCS#11 module for TLS client-cert auth and force-install
the Web eID extension.
