Complete the desktop: default apps, mDNS, firewall, zram, fonts

Wire up features that were half-shipped and add sensible resilience
defaults:

- mimeapps.list in skel: images->loupe, A/V->vlc, text->gnome-text-editor,
  pdf/html->zen, archives->file-roller, dirs->nautilus (so opening a file
  from nautilus actually does something)
- avahi + nss-mdns: CUPS network-printer discovery + .local resolution
  (enable avahi-daemon; insert mdns_minimal into nsswitch hosts:)
- ufw: deny-incoming firewall, mDNS (5353/udp) allowed so discovery still
  works; enabled in post-install
- zram-generator: compressed RAM swap (half RAM capped 4 GiB, zstd)
- fwupd + reflector.timer: firmware updates and periodic mirror refresh
- fonts: ttf-liberation (Office/web metric compat), ttf-dejavu, font-awesome

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

iso/airootfs/etc/systemd/zram-generator.conf

@@ -0,0 +1,6 @@
+# Compressed RAM swap. systemd-zram-generator reads this and creates a zram
+# device + swap at boot — no on-disk swap partition needed. Sized at half RAM
+# capped to 4 GiB, zstd-compressed (typically ~3:1, so cheap headroom).
+[zram0]
+zram-size = min(ram / 2, 4096)
+compression-algorithm = zstd