feat(dotfiles): import env layer as stow-style packages with deploy.sh

Import Dankware's environment layer into the repo as home-relative package
trees (niri, gtk-3/4, ghostty, alacritty, fish, zsh, bash, profile,
systemd-user, dconf). scripts/deploy.sh implements stow-equivalent semantics
(check|adopt|sync modes): identical files adopt to symlinks, new files link,
divergent files quarantine-and-replace under .quarantine/<host>/<ts>/ (gitignored).
zz-<hostname> override packages deploy last with override semantics.

Secrets never enter git: GITEA_TOKEN moved from .zshrc into untracked
~/.config/environment.d/secrets.env (0600); tracked .zshrc sources it
guarded. core.hooksPath armed by deploy.sh so the pre-commit secret gate is
live on every machine that deploys.

dotfiles/systemd-user/.config/systemd/user/shelly-notifications.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Shelly Notifications tray service
+After=graphical-session.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/shelly-notifications
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=graphical-session.target