feat(desktop): GUI askpass for ssh passphrase/PIN prompts

Add ksshaskpass and point SSH_ASKPASS at it, without forcing: a tty still
prompts inline, but a caller may set SSH_ASKPASS_REQUIRE to route the prompt
to the GUI (e.g. a headless context driving `git push`).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home.nix

@@ -36,6 +36,10 @@ in
     # Mute the harmless "Wayland does not support QWindow::requestActivate()"
     # spam Qt apps (keepassxc) print; scoped to that one log category only.
     QT_LOGGING_RULES = "qt.qpa.wayland=false";
+    # GUI helper for ssh passphrase/PIN prompts. Not forced: with a tty ssh still
+    # prompts inline; the helper is only used when a caller sets
+    # SSH_ASKPASS_REQUIRE (e.g. a headless/agent context).
+    SSH_ASKPASS = "${pkgs.ksshaskpass}/bin/ksshaskpass";
   };
   # Sets XDG_{CONFIG,DATA,CACHE}_HOME and enables xdg.configFile management.
   xdg.enable = true;
@@ -48,6 +52,8 @@ in
     # wrapper binary.
     nodejs
     highlight   # `ccat` alias: syntax-highlighted cat
+    libreoffice
+    ksshaskpass   # Qt GUI prompt for ssh passphrase/PIN (see SSH_ASKPASS above)
   ];
 
   # ---- Per-tool config files, routed into XDG dirs ---------------------
@@ -292,6 +298,14 @@ in
 
       "$mod" = "SUPER";
 
+      # Drag to move ($mod+LMB) / resize ($mod+RMB) any window. Needed to reach
+      # oversized floating dialogs (e.g. GTK save/upload pickers) whose confirm
+      # button lands off-screen on short displays.
+      bindm = [
+        "$mod,	mouse:272,	movewindow"
+        "$mod,	mouse:273,	resizewindow"
+      ];
+
       bind = [
         "$mod,		Return,	exec,		footclient"
         "$mod,		q,	killactive"
@@ -344,6 +358,10 @@ in
   # Notification daemon. notify-send clients (e.g. imv's info/delete toasts in
   # modules/media.nix, gpg-agent errors) need a running server on the bus.
   # Minimal to match the desktop: Nerd Font, no rounding, square border.
+  # Secret Service provider (freedesktop org.freedesktop.secrets). Bare Wayland
+  # session has none otherwise; apps using libsecret/qtkeychain need it.
+  services.gnome-keyring.enable = true;
+
   services.mako = {
     enable = true;
     settings = {

modules/media.nix

@@ -36,7 +36,7 @@ in
       "r"         = ''exec magick "$imv_current_file" -rotate 90  "$imv_current_file"'';
       "<Shift+R>" = ''exec magick "$imv_current_file" -rotate -90 "$imv_current_file"'';
       "f"         = ''exec magick "$imv_current_file" -flop "$imv_current_file"'';
-      "g"         = ''exec gimp "$imv_current_file"'';
+      "e"         = ''exec gimp "$imv_current_file"'';                                  # edit; `g` reserved by imv's gg chord
       "i"         = ''exec notify-send "File info" "$(mediainfo "$imv_current_file")"'';
     };
   };
@@ -55,6 +55,6 @@ in
     imagemagick     # `magick`: rotate/flip binds
     mediainfo       # `i` info bind
     libnotify       # notify-send client (daemon = mako, in home.nix)
-    gimp            # `g` open-in-editor bind
+    gimp            # `e` open-in-editor bind
   ];
 }

modules/nixos.nix

@@ -92,6 +92,10 @@
     };
   };
 
+  # Unlock the login keyring with the login password at the greetd prompt,
+  # so the Secret Service is open without a second passphrase.
+  security.pam.services.greetd.enableGnomeKeyring = true;
+
   # XDG portals (screen sharing, file pickers, and so on).
   xdg.portal = {
     enable = true;