Merge master into staging-nixos

- Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.

- Keycloak has been updated to 26.6.X, bringing a lot new features like federated client authentication, JWT authorization grants, workflows and the ability to do

  zero-downtime patch releases. Read more about [all the exciting new capabilities in keycloak 26.6 here](https://github.com/keycloak/keycloak/releases/tag/26.6.0)

  and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out wether this is a breaking

  change for your keycloak instance.

- `elegant-sddm` has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the [wiki](https://wiki.nixos.org/wiki/SDDM_Themes) for more.

- `forgejo` has been updated to major version 14. For more information, see the [release blog post](https://forgejo.org/2026-01-release-v14-0/) and [full release notes](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/14.0.0.md)

  /**

    Concatenate a list of strings, adding a newline at the end of each one.

    Defined as `concatMapStrings (s: s + "\n")`.

    # Inputs

    :::

  */

  concatLines = concatMapStrings (s: s + "\n");

  concatLines = str: concatStringsSep "\n" str + "\n";

  /**

    Given string `s`, replace every occurrence of the string `from` with the string `to`.

    githubId = 39416660;

    name = "Mladen Branković";

  };

  imcvampire = {

    github = "imcvampire";

    githubId = 9426721;

    name = "Quoc-Anh Nguyen";

  };

  imgabe = {

    email = "gabrielpmonte@hotmail.com";

    github = "ImGabe";

    githubId = 61395246;

    name = "Lampros Pitsillos";

  };

  landreussi = {

    email = "lucasandreussi@gmail.com";

    github = "landreussi";

    githubId = 5938518;

    name = "Lucas Andreussi";

  };

  langsjo = {

    name = "langsjo";

    github = "langsjo";

- [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).

- [Strichliste](https://www.strichliste.org), a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as [services.strichliste](#opt-services.strichliste.enable).

- [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).

- [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.

- [hardware.xpadneo](#opt-hardware.xpadneo.enable) now supports configuring kernel module parameters via a freeform [settings](#opt-hardware.xpadneo.settings) option, with convenience options for [rumble attenuation](#opt-hardware.xpadneo.rumbleAttenuation) and [controller quirks](#opt-hardware.xpadneo.quirks).

- The `services.prometheus.exporters` module interface now accepts an optional `socketOpts` attribute, allowing individual exporter modules to describe an accompanying `systemd.sockets.prometheus-${name}-exporter` unit alongside their service, enabling socket activation support.

- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.

- `security.acme` now defaults to a dynamic renewal duration, if

  ./services/web-apps/stash.nix

  ./services/web-apps/stirling-pdf.nix

  ./services/web-apps/strfry.nix

  ./services/web-apps/strichliste.nix

  ./services/web-apps/suwayomi-server.nix

  ./services/web-apps/szurubooru.nix

  ./services/web-apps/tabbyapi.nix