feat(desktop): enable the firewall on desktop machines

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>

modules/nixos/desktop/networking/firewall.nix

@@ -0,0 +1,10 @@
+# Desktops hold personal data and laptops join untrusted networks, so enable the
+# firewall here (repo-wide default is off, see modules/nixos/base/ssh.nix).
+# SSH/Tailscale/LocalSend/Sunshine keep working via their own `openFirewall` options.
+{
+  networking.firewall = {
+    enable = true;
+    # Trust everything from the tailnet.
+    trustedInterfaces = [ "tailscale0" ];
+  };
+}