refactor: centralize unfree package allowlists

Move all allowUnfreePredicate declarations to global configs to prevent
the "last definition wins" merging issue. Unfree packages are now managed
in two central locations:
- NixOS system packages: nixos/common/global/default.nix
- Home Manager packages: home-manager/sajenim/global/default.nix

nixos/common/global/default.nix

@@ -1,4 +1,4 @@
-{outputs, ...}: {
+{outputs, lib, ...}: {
   imports = [
     ./age.nix
     ./env.nix
@@ -15,6 +15,18 @@
     ];
     config = {
       allowUnfree = false;
+      # Centralized unfree package allowlist for NixOS system configuration.
+      # Note: nixpkgs.config.allowUnfreePredicate doesn't merge across modules - only the
+      # last definition wins. To maintain explicit control over unfree packages, we list
+      # all allowed packages here rather than scattering predicates across system modules.
+      allowUnfreePredicate = pkg:
+        builtins.elem (lib.getName pkg) [
+          # Gaming
+          "steam"
+          "steam-unwrapped"
+          # Services
+          "minecraft-server"
+        ];
     };
   };
 

nixos/common/users/sajenim/steam/default.nix

@@ -27,10 +27,4 @@
     "d /home/sajenim/.local 0755 sajenim users -"
     "d /home/sajenim/.local/share 0755 sajenim users -"
   ];
-
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "steam"
-      "steam-unwrapped"
-    ];
 }

nixos/viridian/services/minecraft/default.nix

@@ -116,9 +116,4 @@ in {
       }
     ];
   };
-
-  # Allow unfree packages.
-  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-    "minecraft-server"
-  ];
 }