feat(desktop): workstation polish pack (apparmor, kernel panic, hyprpicker)

modules/home/default.nix

@@ -60,6 +60,7 @@
   home.packages = with pkgs; [
     awww       # wallpaper daemon with animated transitions (the swww fork)
     libnotify
+    hyprpicker
   ];
 
   home.sessionVariables = {

modules/home/keybinds.nix

@@ -54,6 +54,7 @@
     { mods = "$mod CTRL";   key = "P";      action = "exec, nomarchy-menu colorpicker"; desc = "Color picker (→ clipboard)"; }
     { mods = "$mod CTRL";   key = "A";      action = "exec, nomarchy-menu ask";       desc = "Ask Claude"; }
     { mods = "$mod CTRL";   key = "D";      action = "exec, nomarchy-menu dnd";       desc = "Do Not Disturb toggle"; }
+    { mods = "$mod SHIFT";  key = "C";      action = "exec, hyprpicker -a";           desc = "Color picker (→ clipboard)"; }
 
     # Focus — SUPER + arrow keys.
     { mods = "$mod";        key = "left";   action = "movefocus, l";                  desc = "Focus left"; }

modules/nixos/default.nix

@@ -141,6 +141,14 @@ in
       notifications.x11.enable = lib.mkDefault true;
       notifications.wall.enable = lib.mkDefault true;
     };
+    # Core security: enable AppArmor to confine desktop apps and services.
+    security.apparmor.enable = true;
+    security.apparmor.killUnconfinedConfinables = false;
+
+    # Core stability: reboot automatically after 10s on a kernel panic
+    # (prevents the system from hanging indefinitely on a black screen).
+    boot.kernelParams = [ "panic=10" "oops=panic" ];
+
     # Explicitly enable systembus-notify to resolve a mkDefault conflict
     # between earlyoom (true) and smartd (false).
     services.systembus-notify.enable = true;