implement agenix

figure out a way to get firefox policies and plugins set up in webapps

concept:
a nixos-like OS with standardised option sets that nonetheless uses composable flake
pieces to construct the whole OS, breaking the monorepo syndrome

concept:
direnv+flake with services
possibilities:
* flake-containers, but with rootless nspawn?

* make per project systemd user slice and run services out of it
	- can we adapt nixos service modules directly?
	- most lightweight option
	- can share services between projects by sharing slice

* roll an oci image and run inside systemd-nspawn
	- this allows reuse of the entire nixos module system,
		including service config
	- docker-like port forwarding
	- doesn't fucking work, hates nix oci images, fake and bad
