fix(xdg): order autostart apps after xdg-desktop-portal

At login the xdg-autostart-generator starts apps at
graphical-session.target, racing the portal user services. Sandboxed
apps (nixpak firefox/telegram) end up with broken FileChooser/OpenURI
until manually restarted.

Add a template drop-in on app-@autostart.service that makes every
autostart app wait for the portal stack.

home/linux/gui/base/xdg/autostart.nix

@@ -5,7 +5,11 @@
   ...
 }:
 {
-  # XDG autostart entries - ensures apps start after portal services are ready
+  # XDG autostart entries. All of them are globally ordered after the
+  # xdg-desktop-portal stack via `systemd.user.units."app-@autostart.service"`
+  # in modules/nixos/desktop/xdg.nix, so sandboxed apps (nixpak: firefox,
+  # telegram, ...) don't race the portal at login and end up with broken
+  # FileChooser/OpenURI until manually restarted.
   xdg.autostart.enable = true;
   # This fixes nixpak sandboxed apps (like firefox) accessing mapped folders correctly
   xdg.autostart.entries = [

modules/nixos/desktop/xdg.nix

@@ -56,4 +56,22 @@
       xdg-desktop-portal-gnome # for screensharing
     ];
   };
+
+  # The xdg-autostart-generator starts every autostart app (including nixpak
+  # sandboxes like firefox/telegram) right at graphical-session.target, while
+  # the portal user services come up around the same time (xdg-desktop-portal-gtk
+  # is even ordered after graphical-session.target). This template drop-in makes
+  # every `app-*@autostart.service` wait for the portal stack, so portal-dependent
+  # features (FileChooser upload/save dialogs, OpenURI) work on first launch
+  # instead of needing a manual app restart after login.
+  systemd.user.units."app-@autostart.service" = {
+    # Template drop-in: applies to every `app-*.desktop` instance generated by
+    # systemd-xdg-autostart-generator, current and future.
+    overrideStrategy = "asDropin";
+    text = ''
+      [Unit]
+      After=xdg-desktop-portal.service xdg-desktop-portal-gtk.service xdg-desktop-portal-gnome.service
+      Wants=xdg-desktop-portal.service xdg-desktop-portal-gtk.service xdg-desktop-portal-gnome.service
+    '';
+  };
 }