feat(nixpak): unify desktop app sandboxes (#491)

* refactor(nixpak): unify desktop app sandboxes

Move common GUI, portal, and network policy into reusable modules and migrate browsers plus Zoom/WeChat/QQ/Telegram to the same boundary.

Assisted-by: DeepSeek Harness (deepseek-flash)

outputs/x86_64-linux/tests/nixpak-policy/expected.nix

@@ -0,0 +1 @@
+{ ... }: true

outputs/x86_64-linux/tests/nixpak-policy/expr.nix

@@ -0,0 +1,11 @@
+{ inputs, outputs, ... }:
+let
+  pkgs = outputs.nixosConfigurations.ai-niri.pkgs;
+in
+import ../../../../hardening/tests/policy.nix {
+  inherit pkgs;
+  mkNixPak = inputs.nixpak.lib.nixpak {
+    inherit pkgs;
+    inherit (pkgs) lib;
+  };
+}