refactor: reorganize flake structure and consolidate user config

Directory structure:
- Move from src/ to root level (system/, user/)
- Remove unused machines (workstation, vm, laptop)

User configuration:
- Add user/home.nix for shared defaults (pass, essentials, default modules)
- Centralize user options in user/default.nix
- Move submodules to consistent paths (bash/bash, git/git, neovim/nvim, vim/vim)

Module reorganization:
- Flatten nested module structures (remove /modules/ subdirs)
- Split CLI vs GUI tools (dev/ for CLI, gui/dev/ for GUI)
- Move neovim/vim to top-level modules (not under utils/)
- Remove security.enable - pass now in user/home.nix
- Remove utils.enable - essentials now in user/home.nix
- Add security/yubikey module with yubikey-manager, age-plugin-yubikey
- Move pcb, design to gui/dev/
- Replace penpot docker wrapper with nixpkgs penpot-desktop
- Remove i3 config
- Remove deprecated wsl.nativeSystemd option

GUI improvements:
- Browser-focused mimeApps in gui/default.nix
- Each WM handles its own auto-start via profileExtra

Cleanup:
- Update README with new structure
- Update justfile paths and valid systems
- Fix submodule paths in .gitmodules

user/modules/tmux/config/tmux.nix

@@ -0,0 +1,44 @@
+''
+bind -n M-C source-file ~/.config/tmux/tmux.conf
+
+# Navigation (matches hyprland Alt+hjkl)
+bind-key -n M-h select-pane -L
+bind-key -n M-j select-pane -D
+bind-key -n M-k select-pane -U
+bind-key -n M-l select-pane -R
+
+# Move/swap pane (matches hyprland Alt+Shift+hjkl)
+bind-key -n M-H swap-pane -s '{left-of}'
+bind-key -n M-J swap-pane -s '{down-of}'
+bind-key -n M-K swap-pane -s '{up-of}'
+bind-key -n M-L swap-pane -s '{right-of}'
+
+# Actions
+bind-key -n M-q kill-pane
+bind-key -n M-Return split-window -c "#{pane_current_path}"
+bind-key -n M-f resize-pane -Z
+
+# Windows (like workspaces)
+bind-key -n M-1 select-window -t 1
+bind-key -n M-2 select-window -t 2
+bind-key -n M-3 select-window -t 3
+bind-key -n M-4 select-window -t 4
+bind-key -n M-5 select-window -t 5
+bind-key -n M-6 select-window -t 6
+bind-key -n M-7 select-window -t 7
+bind-key -n M-8 select-window -t 8
+bind-key -n M-9 select-window -t 9
+bind-key -n M-0 select-window -t 10
+
+# Move pane to window (like move to workspace)
+bind-key -n M-! join-pane -t :1
+bind-key -n M-@ join-pane -t :2
+bind-key -n M-'#' join-pane -t :3
+bind-key -n M-'$' join-pane -t :4
+bind-key -n M-% join-pane -t :5
+bind-key -n M-^ join-pane -t :6
+bind-key -n M-& join-pane -t :7
+bind-key -n M-* join-pane -t :8
+bind-key -n M-( join-pane -t :9
+bind-key -n M-) join-pane -t :10
+''

user/modules/tmux/default.nix

@@ -0,0 +1,44 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.user.tmux;
+  gui = config.modules.user.gui.wm;
+
+  wm = {
+    enable = builtins.any (mod: mod.enable or false) (builtins.attrValues gui);
+  };
+
+in
+{ options.modules.user.tmux = { enable = mkEnableOption "Enable tmux module"; };
+  config = mkIf cfg.enable {
+    programs.tmux = {
+      enable = true;
+      newSession = true;
+      disableConfirmationPrompt = true;
+      keyMode = "vi";
+      mouse = if wm.enable then true else false;
+
+      prefix = "M";
+      #shell = "\${pkgs.bash}/bin/bash";
+
+      plugins = with pkgs.tmuxPlugins; [
+        {
+          plugin = tilish;
+          extraConfig = ''
+            set -g @tilish-default 'tiled'
+          '';
+        }
+      ];
+
+      extraConfig = import ./config/tmux.nix;
+    };
+
+    # Auto-start tmux only on local TTY (not SSH, not in tmux already)
+    programs.bash.profileExtra = mkIf (!wm.enable) ''
+      if [[ $- == *i* ]] && [ -z "$DISPLAY" ] && [ -z "$TMUX" ] && [ -z "$SSH_TTY" ] && [ -z "$SSH_CONNECTION" ]; then
+        exec tmux
+      fi
+    '';
+  };
+}