At login the xdg-autostart-generator starts apps at
graphical-session.target, racing the portal user services. Sandboxed
apps (nixpak firefox/telegram) end up with broken FileChooser/OpenURI
until manually restarted.
Add a template drop-in on app-@autostart.service that makes every
autostart app wait for the portal stack.