fix(firefox): share MPRIS artwork, trash and host config paths

The sandbox remaps XDG_DATA_HOME/XDG_CONFIG_HOME, so paths Firefox exposes to
or shares with the host ended up isolated. Bind the MPRIS artwork dir and the
real trash rw, and mimeapps.list, user-dirs.dirs and the shared NSS cert store
ro.

recently-used.xbel stays isolated: GTK writes it atomically, which a
single-file rw bind would break.

hardening/nixpaks/firefox.nix

@@ -43,6 +43,15 @@ let
             # NOTE: sloth.mkdir is used to create the directory if it does not exist!
             (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
 
+            # MPRIS artwork: Firefox writes covers here and advertises the same
+            # path over MPRIS. Without this bind it lands under the sandboxed
+            # XDG_DATA_HOME and Noctalia (outside) cannot read it.
+            (sloth.mkdir (sloth.concat' sloth.homeDir "/.local/share/firefox-mpris"))
+
+            # Files deleted from Firefox go to the real trash instead of a
+            # private one under the sandboxed XDG_DATA_HOME.
+            (sloth.mkdir (sloth.concat' sloth.homeDir "/.local/share/Trash"))
+
             sloth.xdgDocumentsDir
             sloth.xdgDownloadDir
             sloth.xdgMusicDir
@@ -62,6 +71,13 @@ let
             (sloth.concat' sloth.homeDir "/.local/share/password-store") # my secrets
             (sloth.concat' sloth.runtimeDir "/gnupg") # for access gpg-agent socket
 
+            # Match the host's default-app associations and XDG user dirs.
+            (sloth.concat' sloth.homeDir "/.config/mimeapps.list")
+            (sloth.concat' sloth.homeDir "/.config/user-dirs.dirs")
+
+            # Shared NSS client-certificate store (imported outside Firefox).
+            (sloth.concat' sloth.homeDir "/.pki/nssdb")
+
             # Unsure
             (sloth.concat' sloth.xdgConfigHome "/dconf")
           ];