Keyring launchers, Firefox default browser, rootless Docker

- keyring.flatpaks / keyring.programs: desktop entries shadowing an app's
  own that run it on the outer bus (one kwalletd6 for both sessions), with
  the wallet's D-Bus names as `flatpak run --talk-name` options (no Flatpak
  overrides), --password-store=kwallet6 for Electron, and login callback
  schemes as default + recommended handlers.
- firefox.defaultBrowser: the launcher as default for http, https and
  text/html.
- docker: rootless dockerd as a user service, socket in the outer runtime
  dir, CLI with DOCKER_HOST for both sessions.

docs/session.md

@@ -23,8 +23,9 @@ running") and skips `reloadSystemd`.
   and applies `session.services.start` / `stop` / `restart`, which other
   modules fill (you can add your own units).
 
-**Configuration:** a launcher for an app that must use the single wallet on
-the outer bus (see [Two sessions](../README.md#two-sessions)):
+**Configuration:** apps that keep secrets in the wallet get launchers from
+[keyring](keyring.md). Another launcher that must reach the outer session
+(its bus, services or wallet) uses the prefix:
 
 ```nix
 { config, ... }: {