fix anti-patterns: niri portals, nix optimise, zram; add dev packages

- niri: remove explicit package override (use niri-flake default), drop
  KDE portal, set xdg.portal.config for deterministic portal resolution,
  remove unused waybar
- core: replace synchronous auto-optimise-store with async
  nix.optimise.automatic, reduce zramSwap.memoryPercent from 300 to 100
- dev: add python3 and uv to system packages
- add .mcp.json (nixos MCP server) and CLAUDE.md

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "nixos": {
+      "command": "uvx",
+      "args": ["mcp-nixos"]
+    }
+  }
+}

CLAUDE.md

@@ -0,0 +1,94 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Architecture: Dendritic Pattern
+
+This config uses the **[den](https://github.com/vic/den)** framework with the **dendritic pattern** — configurations are composed from reusable *aspects* rather than per-host files.
+
+Key concepts:
+- **Aspects** (`den.aspects.<name>`) — named, composable feature modules. Each aspect can define `nixos` (system config) and/or `homeManager` (user config) blocks.
+- **Hosts** (`den.hosts.x86_64-linux.<hostname>`) — defined in `modules/den.nix`, each assigned an aspect that lists its includes.
+- **`import-tree`** — automatically imports all `.nix` files under `modules/`, so adding a new file is enough to register it.
+- **`flake-aspects`** — wires the den module system into the flake output.
+
+Host→aspect mapping (from `modules/den.nix`):
+- `desktop` — gaming + dev + creative, Nvidia GPU
+- `notebook` — portable dev + creative, Intel GPU
+- `work` — portable dev only, no gaming/creative
+
+## Module layout
+
+```
+modules/
+  den.nix          # host declarations and aspect composition
+  output.nix       # exposes flake.nixosConfigurations option
+  identity.nix     # local.identity options (username, email, SSH key)
+  core.nix         # base: nix settings, caches, locale, base packages
+  services.nix     # shared system services
+  wayland.nix      # Wayland env vars
+  niri.nix         # niri compositor + quickshell bar + display tools
+  dev.nix          # dev tools, LSPs, Docker, JDKs (system-level)
+  portable.nix     # power management, TLP, firewall
+  desktop.nix      # desktop-specific hardware/packages
+  notebook.nix     # notebook-specific packages
+  work.nix         # work-specific packages
+  secrets.nix      # sops-nix integration
+  _hardware/       # per-host hardware-configuration.nix files
+  _home/           # home-manager modules (imported by den.aspects.zoty)
+    default.nix    # zsh, direnv, common home packages (firefox, kitty, claude-code)
+    niri.nix       # niri home config
+    git.nix        # git identity
+    theme.nix      # GTK/icon theme
+    cursor.nix     # cursor theme
+    dolphin.nix    # file manager
+    xdg-dirs.nix   # XDG directory overrides
+quickshell/        # QML bar widgets (quickshell + qml-niri)
+```
+
+## Common commands
+
+```bash
+just switch              # rebuild + switch (uses current hostname)
+just switch desktop      # target a specific host
+just build               # build only, don't switch
+just test                # apply temporarily (reverts on next boot)
+just diff                # show what changed vs running system
+just check               # evaluate flake for errors
+just update              # update all flake inputs
+just update-input nixpkgs  # update a single input
+just gc                  # garbage collect (>7 days old)
+just repl                # nix repl with flake loaded
+just secrets             # edit SOPS-encrypted secrets
+just iso                 # build installer ISO
+```
+
+## Inputs
+
+| Input | Channel | Role |
+|---|---|---|
+| `nixpkgs` | nixos-25.11 | stable packages |
+| `nixpkgs-unstable` | nixos-unstable | neovim, JDKs, some dev tools |
+| `home-manager` | release-25.11 | user environment |
+| `sops-nix` | — | secret decryption at boot |
+| `niri-flake` | — | niri compositor |
+| `disko` | — | declarative disk partitioning |
+| `claude-code` | sadjow/claude-code-nix | claude-code CLI |
+| `qml-niri` | imiric/qml-niri | quickshell niri integration |
+
+## Secrets (SOPS + age)
+
+- Encrypted in `secrets/secrets.yaml`, decrypted at boot by sops-nix.
+- Age key must exist at `/etc/sops/age/keys.txt` before first deploy.
+- New secrets: add to `just secrets`, then declare in `modules/secrets.nix`.
+- New host key: add public key to `.sops.yaml`, then run `sops updatekeys secrets/secrets.yaml`.
+
+## Adding a new host
+
+1. Copy hardware config to `modules/_hardware/<hostname>-hardware.nix`.
+2. Add `den.hosts.x86_64-linux.<hostname>` in `modules/den.nix`.
+3. Define a `den.aspects.<hostname>` with the desired `includes` list.
+
+## Identity
+
+Global identity (username, full name, email, SSH key) is declared as NixOS options in `modules/identity.nix` and passed to home-manager modules via `specialArgs`. Override `local.identity.*` options in a host aspect when needed.

modules/core.nix

@@ -8,7 +8,6 @@
     nix = {
       settings = {
         experimental-features = [ "nix-command" "flakes" ];
-        auto-optimise-store = true;
         substituters = [
           "https://cache.nixos.org"
           "https://niri.cachix.org"
@@ -27,12 +26,13 @@
         dates = "weekly";
         options = "--delete-older-than 7d";
       };
+      optimise.automatic = true;
     };
 
     zramSwap =  {
       enable = true;
       algorithm = "zstd";
-      memoryPercent = 300;
+      memoryPercent = 100;
     };
 
     services.xserver.enable = false;

modules/dev.nix

@@ -12,6 +12,8 @@ in {
     environment.systemPackages = with pkgs-unstable; [
       # CLI utilities
       gcc
+      python3
+      uv
       fzf
       just
       tree-sitter

modules/niri.nix

@@ -7,16 +7,12 @@
 
     fonts.packages = [ pkgs.nerd-fonts.jetbrains-mono ];
 
-    programs.niri = {
-      enable  = true;
-      package = pkgs.niri;
-    };
+    programs.niri.enable = true;
 
     programs.gpu-screen-recorder.enable = true;
 
     environment.systemPackages = with pkgs; [
       quickshell-niri
-      waybar
       fuzzel
       swaylock
       swayidle
@@ -25,7 +21,6 @@
       slurp
       wl-clipboard
       xdg-desktop-portal-gnome
-      kdePackages.xdg-desktop-portal-kde
       xwayland-satellite
       gpu-screen-recorder-gtk
       libnotify
@@ -35,10 +30,8 @@
  
     xdg.portal = {
       enable       = true;
-      extraPortals  = [
-        pkgs.xdg-desktop-portal-gnome 
-        pkgs.kdePackages.xdg-desktop-portal-kde
-      ];
+      extraPortals = [ pkgs.xdg-desktop-portal-gnome ];
+      config.common.default = [ "gnome" ];
     };
 
     security.pam.services.swaylock = {};