Keyring launchers, Firefox default browser, rootless Docker

- keyring.flatpaks / keyring.programs: desktop entries shadowing an app's
  own that run it on the outer bus (one kwalletd6 for both sessions), with
  the wallet's D-Bus names as `flatpak run --talk-name` options (no Flatpak
  overrides), --password-store=kwallet6 for Electron, and login callback
  schemes as default + recommended handlers.
- firefox.defaultBrowser: the launcher as default for http, https and
  text/html.
- docker: rootless dockerd as a user service, socket in the outer runtime
  dir, CLI with DOCKER_HOST for both sessions.

template/home.nix

@@ -56,8 +56,17 @@
   #   firefox.enable = true;             # launcher for the Firefox Flatpak
   #   # the Frame has no AV1 decoder: sites send VP9/H.264 (hardware):
   #   firefox.disableAv1 = true;
+  #   firefox.defaultBrowser = true;     # default for http/https links
   #   # Hardware video decoding in the Jellyfin Desktop Flatpak (install
   #   # org.jellyfin.JellyfinDesktop yourself); gives it devices=all:
   #   jellyfin.hardwareDecoding.enable = true;
+  #   # Apps that keep logins in the KDE wallet: one wallet for both
+  #   # sessions (Element: install im.riot.Riot yourself):
+  #   keyring.flatpaks."im.riot.Riot" = {
+  #     name = "Element";
+  #     electron = true;
+  #     schemeHandlers = [ "element" "io.element.desktop" ];  # SSO callback
+  #   };
+  #   docker.enable = true;              # rootless Docker, user service
   # };
 }