feat(desktop): let imperative nix commands see allowUnfree

modules/desktop.nix

@@ -354,6 +354,14 @@ in
   # Polkit agent for privilege prompts inside the session.
   security.polkit.enable = true;
 
+  # nixpkgs.config.allowUnfree covers the system build only. `nix profile` and
+  # friends evaluate a flake purely, so they see neither that setting nor
+  # ~/.config/nixpkgs/config.nix, and refuse every unfree package. The hosts
+  # already declare unfree as acceptable; this makes the imperative commands
+  # agree instead of demanding NIXPKGS_ALLOW_UNFREE=1 in front of each one.
+  # Set by PAM at session start, so it takes a re-login, not just a rebuild.
+  environment.sessionVariables.NIXPKGS_ALLOW_UNFREE = "1";
+
   # Seed configs for programs that read only from the home directory and have
   # no system-wide fallback. 'C' copies once and never overwrites, so user
   # edits survive. This is what post-install.sh does imperatively on Arch.