refactor(modules): one topic per module, and Firefox preconfigured

Two changes that cannot be separated in the result: the Firefox
preconfiguration is what made desktop.nix untenable, and the split is what it
now lives in.

Firefox replaces LibreWolf, with Betterfox as its preference base and the
settings that Betterfox does not cover expressed as policies: uBlock Origin,
the Catppuccin theme, no Pocket, no Sync, autoscroll, DuckDuckGo, no
translation offer, no password prompts, no bookmarks toolbar, about:blank as
home and new tab. Both add-ons are normal_installed and the preferences keep
status "default", so none of it is locked away — undoing settings by hand was
the reason to leave LibreWolf.

desktop.nix carried thirteen topics over 637 lines, and the existing split
followed the NixOS option namespace rather than the topic: services.pipewire
here, its configPackages there; services.gvfs and services.udisks2 apart from
their packages; Bluetooth likewise. Nine modules now each hold one topic with
its options, packages, configs and services together. desktop.nix keeps the
compositor, the /etc deployment, portals and what belongs to no topic.

The refactor changes nothing about the built system, and that was checked
after each of the eight steps rather than assumed. The plain store path does
not serve as the criterion: moving a package to another module reorders
environment.systemPackages, which changes the system-path hash and propagates
into every file naming it. What was compared instead is the package set
through diff-closures and every differing file with store hashes normalised
away. Two steps reordered the user tmpfiles list, which is neutral only
because no two rules name the same path — checked, not presumed.

modules/services.nix

@@ -157,21 +157,8 @@ let
   };
 in
 {
-  # --- Audio ---
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    jack.enable = true;
-  };
-
   # --- Hardware ---
-  hardware.bluetooth.enable = true;
-  services.blueman.enable = true;
-  services.udisks2.enable = true;
   services.upower.enable = true;
-  services.gvfs.enable = true;
   services.fwupd.enable = true;
   # power-profiles-daemon over auto-cpufreq: on amd-pstate in active mode the
   # platform decides the frequency from the min/max and EPP registers alone, so
@@ -179,9 +166,6 @@ in
   # where neither exists it falls back to a driver that touches no hardware.
   services.power-profiles-daemon.enable = true;
 
-  # --- Firewall, replaces the ufw calls in post-install.sh ---
-  networking.firewall.enable = true;
-
   # --- System services from defaults/etc/systemd/system/ ---
   #
   # Rebuilt rather than copied, same reason as the user units: the originals