modules/tools/browsers: finish the browser abstraction

[RISK-alt]

This picks up #71, which was said not to be moving any time soon, and finishes
it. The first commit is Ryan's original, rebased on main with his authorship and
sign-off intact; everything after it is mine.

The module did not evaluate. Seven distinct issues, fixed in one commit and
listed in its message. The one worth calling out: programs.chromium.extraOpts
is a types.attrs, whose merge is a shallow //, so the module system never
discharges a nested mkIf. The two in ProxySettings would have been
serialised into the policy JSON as {"_type":"if",...}. They are built with
optionalAttrs now.

The abstraction removed Firefox from the system. securix.browser.enable
defaulted to false and nothing enabled it. The browser list now defaults to
Firefox, which is what Sécurix shipped so far, and the default lives on the
option rather than in modules/tools/default.nix because list options
concatenate on merge — a definition there would force users to mkForce their
way out. Chromium stays one option away. The Tridactyl native messaging host and
the Bitwarden extension, both dropped by the refactor, are back.

Chromium was never installed. programs.chromium only writes policy files,
so picking Chromium configured a browser that was not there.

The Chromium policies did not apply. They were written to initialPrefs,
which feeds /etc/chromium/initial_preferences and follows the initial
preferences schema, not the enterprise policy one. Moved to extraOpts. Three
policy names do not exist as written, checked against
components/policy/resources/templates/policies.yaml:

• IsolateOrigins is typed as a string of comma separated origins; the intent
  here is SitePerProcess;
• GenAiSettings is GenAiDefaultSettings, an int-enum where 2 means "do not
  allow GenAI features";
• BuiltInAIAPIIsEnabled is BuiltInAIAPIsEnabled.

I only touched placement and invalid names, not the values that were chosen.

A test covers it. tests/browsers builds a terminal with both browsers and
asserts on the Firefox policy file, both Chromium managed policy files, the
presence of each browser in the system profile, and the local dashboard
answering on its port. It would have caught the initialPrefs bug.

One behaviour note for reviewers: securix.firefox.bookmarks still works, but
it no longer feeds the local dashboard — securix.browser.bookmarks does. I did
not add a compatibility shim; say the word if you want one.

This is the groundwork for #208, which I will send as a follow-up on top of this
branch.

[RISK-alt]

For this PR, as usual, I used AI to help me put the problem into context, after which I drafted a plan/implementation strategy to help me think through the solution. I then provided clear instructions so that it could carry out what I wanted to do more quickly. After that, I checked the code for completeness (hence the “temp”). Finally, I made a few corrections.

[rlahfa-dinum]

Can we avoid Claude-style comments in the code? This reads very unnatural to me.

[RISK-alt]

Rewritten in the commit that introduces the binding:

# `extraOpts` is a plain attribute set: a nested `mkIf` is not discharged and
# would land verbatim in the policy JSON.

Kept to two lines because that constraint is the reason proxySettings exists as a separate binding instead of an inline mkIf.

[rlahfa-dinum]

If we are in PAC mode, shouldn't the ProxyPacMandatory be true?

[RISK-alt]

Yes. It is true now, and since the key is only read in pac_script mode I moved it next to ProxyPacUrl, in the PAC-conditional block:

// optionalAttrs (cfg.proxy.autoConfigURL != null) {
  ProxyPacUrl = cfg.proxy.autoConfigURL;
  # Do not fall back to a direct connection when the PAC script cannot be
  # fetched.
  # TODO: expose an option called `cfg.proxy.autoConfigFailSafe`
  ProxyPacMandatory = true;
}

Your TODO stays: that option is how one would opt back into failing open. Done as its own commit since it changes behaviour rather than fixing the port.

[rlahfa-dinum]

This is a first pass, a couple of items, mostly cosmetic and some are important (LLM style comments are not helpful).

[RISK-alt]

Force-pushed. Rebased on main, and the review items are folded into the commits that introduced the code rather than appended as fixups, plus two new commits at the end (Tridactyl, PAC).

One thing to flag that comes from the rebase rather than the review: #221 landed securix.tools.enable, disabled by default. securix.browser.enable = lib.mkDefault true therefore now sits inside that mkIf, so no browser is configured unless tools are enabled. Hoisting it out of the gate would put a browser back on every install, which is the opposite of what #221 is for, so I kept it inside and tests/browsers.nix sets tools.enable = true. Tell me if you would rather have it the other way.

The tests failure on the previous run was the binary cache post-build-hook on a fork PR (AWS error fetching 'nix-cache-info'), which #236 fixed after that run. Nothing is evaluated on my side, so this CI run is the first real check.

[rlahfa-dinum]

All that is left is the tridactyl revert commit, I believe and we are good to go.

[RISK-alt]

Pushed as a fast-forward, the eight commits you reviewed are untouched and 55dfdbb is appended on top. #240 rebased onto it.

[ldesgouilles-dinum]

I did preliminary integration in our Bureautix repo and it looks good to me, thank you for the work!
Just a note, on a fresh start with no previous state, Chromium decides to show me about://new-tab-page instead of the homepage, but the homepage button properly brings me to localhost:8082. I don't know why is that but I don't think we should block this PR because of this.