fix(desktop): xdg-open goes through the portal, so FHS sandboxes get Firefox

acli auth login opened Chromium. buildFHSEnv binds only an allowlist of /etc
entries into its bubblewrap sandbox, and /etc/xdg is not on it, so the
mimeapps.list from xdg.mime is invisible there and xdg-open takes the first
http handler in mimeinfo.cache. The same holds for Steam and AppImages.
xdg.portal.xdgOpenUsePortal hands the URL to the OpenURI portal, which
resolves it on the host (NixOS/nixpkgs#160923).

acli and kubectl on the ThinkPad. Flake inputs updated.

modules/desktop.nix

@@ -118,6 +118,14 @@ in
     # awake. programs.niri leaves this interface unassigned, so stating it here
     # does not collide with the module's definition.
     config.niri."org.freedesktop.impl.portal.Inhibit" = "none";
+
+    # buildFHSEnv sandboxes (acli, Steam, AppImages) bind only an allowlist of
+    # /etc entries, and /etc/xdg is not on it, so an xdg-open inside them never
+    # sees the xdg.mime defaults and takes the first handler in mimeinfo.cache —
+    # Chromium for http. With this set, nixpkgs' xdg-open hands the URL to the
+    # OpenURI portal instead, which resolves it on the host. See
+    # NixOS/nixpkgs#160923.
+    xdgOpenUsePortal = true;
   };
 
   # The file dialog every portal client opens — Firefox's save dialog among