feat: zsh default shell + starship/bat/eza/zoxide shell experience

zsh is now the default login shell (programs.zsh.enable +
users.defaultUserShell, mkOverride 500 to beat bash.nix's mkDefault;
per-user shell= still overrides). modules/home/shell.nix configures the
interactive experience (nomarchy.shell.enable):

- zsh: completion, autosuggestions, syntax highlighting, big shared
  history, autocd.
- starship prompt themed from the palette (a `nomarchy` palette built
  from theme-state.json colors).
- bat as cat (theme "ansi" → tracks the terminal/theme palette), eza as
  ls (icons + git + dirs-first), zoxide as cd (--cmd cd).
- rg/fd shipped as themselves — deliberately NOT aliased over grep/find
  (flag differences surprise).

home.shell.enableZshIntegration = true is the single lever; starship,
eza, zoxide, ghostty and yazi all emit their zsh hooks from it (no
per-module edits). Verified: flake check green, default shell resolves
to zsh, .zshrc carries the starship/zoxide/eza/yazi hooks + aliases,
starship palette renders, all tools in the live ISO closure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -71,6 +71,17 @@ in
     services.upower.enable = lib.mkDefault true;
     networking.networkmanager.enable = lib.mkDefault true;
 
+    # zsh as the default login shell (the desktop's shell experience —
+    # starship/bat/eza/zoxide — is configured home-side in shell.nix).
+    # programs.zsh.enable wires /etc/zshrc, completion and /etc/shells;
+    # defaultUserShell applies to normal users that don't set their own.
+    programs.zsh.enable = lib.mkDefault true;
+    # mkOverride 500: beats nixpkgs' bash.nix `mkDefault bashInteractive`
+    # (equal mkDefault priority would conflict) while staying below a
+    # plain downstream assignment. A per-user `users.users.<n>.shell`
+    # overrides this regardless.
+    users.defaultUserShell = lib.mkOverride 500 pkgs.zsh;
+
     hardware.bluetooth.enable = lib.mkDefault cfg.bluetooth.enable;
     services.blueman.enable = lib.mkDefault cfg.bluetooth.enable;