fix(tailscale): open Tailscale's WireGuard port in the firewall

services.tailscale.openFirewall defaults to false while the NixOS
firewall is enabled, so argon, krypton and neon dropped unsolicited
inbound 41641/udp. Direct connections then only succeed if the other
peer accepts inbound; between two of these hosts (or a host and a
phone) traffic can fall back to a DERP relay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/home-manager/git.nix

@@ -24,6 +24,7 @@ in
 
   programs.git = {
     enable = true;
+    lfs.enable = true;
     settings = {
       push.autoSetupRemote = true;
       user = {

modules/home-manager/programs.nix

@@ -8,6 +8,7 @@
     fastfetch
     keepassxc
     signal-desktop
+    tea
     teamspeak6-client
     typst
     zathura

modules/home-manager/stylix.nix

@@ -1,5 +1,5 @@
 # One Nord palette for everything stylix has a target for: gtk, qt,
-# noctalia, ghostty. Niri has no target and reads the colors in niri.nix. 
+# noctalia, ghostty. Niri has no target and reads the colors in niri.nix.
 # Only the home-manager module is used, so boot, console and sddm are left alone.
 
 { pkgs, ... }:

modules/nixos/services.nix

@@ -4,6 +4,10 @@
     tuned.enable = true;
     upower.enable = true;
     fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
   };
 }