fix(home): open PDFs from sandboxed apps in Firefox

Assisted-by: DeepSeek Harness (claude-opus-5-5)

home/linux/gui/base/xdg/mime.nix

@@ -25,7 +25,7 @@
       in
       {
         "application/json" = browser;
-        "application/pdf" = browser;
+        "application/pdf" = [ "org.mozilla.firefox.desktop" ];
 
         "text/html" = browser;
         "text/xml" = browser;
@@ -68,6 +68,12 @@
         "inode/directory" = [ "yazi.desktop" ];
       };
 
+    # The portal app chooser used by sandboxed apps (e.g. Telegram) lists only these
+    # and the types a desktop entry declares, never the defaults above.
+    associations.added = {
+      "application/pdf" = [ "org.mozilla.firefox.desktop" ];
+    };
+
     associations.removed = {
       # ......
     };