Complete the desktop: default apps, mDNS, firewall, zram, fonts
Wire up features that were half-shipped and add sensible resilience
defaults:
- mimeapps.list in skel: images->loupe, A/V->vlc, text->gnome-text-editor,
pdf/html->zen, archives->file-roller, dirs->nautilus (so opening a file
from nautilus actually does something)
- avahi + nss-mdns: CUPS network-printer discovery + .local resolution
(enable avahi-daemon; insert mdns_minimal into nsswitch hosts:)
- ufw: deny-incoming firewall, mDNS (5353/udp) allowed so discovery still
works; enabled in post-install
- zram-generator: compressed RAM swap (half RAM capped 4 GiB, zstd)
- fwupd + reflector.timer: firmware updates and periodic mirror refresh
- fonts: ttf-liberation (Office/web metric compat), ttf-dejavu, font-awesome
0457bac59a