refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

user/modules/gui/browsers/chromium/default.nix

@@ -0,0 +1,53 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.user.gui.browser.chromium;
+
+in
+{ options.modules.user.gui.browser.chromium = { enable = mkEnableOption "Enable Chromium browser"; };
+  config = mkIf cfg.enable {
+    programs = {
+      chromium = rec {
+        enable = true;
+        package = pkgs.ungoogled-chromium;
+        extensions =
+        let
+          vrs = package.version;
+        in
+        [
+          rec {
+            id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";
+            crxPath = builtins.fetchurl {
+              url = "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=${vrs}&acceptformat=crx2,crx3&x=id%3D${id}%26uc";
+              name = "ublock_${version}.crx";
+              sha256 = "0ycnkna72n969crgxfy2lc1qbndjqrj46b9gr5l9b7pgfxi5q0ll";
+            };
+            version = "1.62.0";
+          }
+          rec {
+            id = "dbepggeogbaibhgnhhndojpepiihcmeb";
+            crxPath = builtins.fetchurl {
+              url = "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=${vrs}&acceptformat=crx2,crx3&x=id%3D${id}%26uc";
+              name = "vimium_${version}.crx";
+              sha256 = "0m8xski05w2r8igj675sxrlkzxlrl59j3a7m0r6c8pwcvka0r88d";
+            };
+            version = "2.1.2";
+          }
+          rec {
+            id = "naepdomgkenhinolocfifgehidddafch";
+            crxPath = builtins.fetchurl {
+              url = "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=${vrs}&acceptformat=crx2,crx3&x=id%3D${id}%26uc";
+              name = "browserpass_${version}.crx";
+              sha256 = "074sc9hxh7vh5j79yjhsrnhb5k4dv3bh5vip0jr30hkkni7nygbd";
+            };
+            version = "3.9.0";
+          }
+        ];
+      };
+      browserpass = {
+        enable = true;
+      };
+    };
+  };
+}