refactor(fuchsia): reorganize audio and bluetooth configuration

Separated PipeWire audio configuration from bluetooth hardware settings for
better logical organization. Moved bluetooth config to hardware-configuration.nix
alongside kernel module workarounds (disable_ertm, iwlwifi power_save).

Also added documentation for permittedInsecurePackages in global config and
updated flake dependencies.

nixos/common/global/default.nix

@@ -35,6 +35,12 @@
           # Services
           "minecraft-server"
         ];
+
+      # Allow specific packages with known CVEs when required by dependencies.
+      # Only add packages here when no secure alternative exists.
+      permittedInsecurePackages = [
+        "mbedtls-2.28.10" # required for orca-slicer
+      ];
     };
   };
 

nixos/fuchsia/hardware-configuration.nix

@@ -29,6 +29,14 @@
     # The set of kernel modules to be loaded in the second stage of the boot process.
     kernelModules = ["i2c-dev" "i2c-piix4"];
 
+    # Hardware-specific kernel module workarounds
+    extraModprobeConfig = ''
+      # Disable Bluetooth Enhanced Retransmission Mode to fix connectivity issues
+      options bluetooth disable_ertm=1
+      # Disable WiFi power saving to prevent connection drops
+      options iwlwifi power_save=0
+    '';
+
     # Our boot loader configuration
     loader = {
       efi = {
@@ -47,6 +55,14 @@
     bluetooth = {
       enable = true;
       powerOnBoot = true;
+      settings = {
+        General = {
+          ControllerMode = "dual";
+          FastConnectable = true;
+          Experimental = true;
+          MultiProfile = "multiple";
+        };
+      };
     };
     graphics = {
       enable = true;

nixos/fuchsia/services/audio/default.nix

@@ -1,18 +1,19 @@
 { pkgs, ... }: {
-  # Realtime scheduler
+  # Realtime scheduler for low-latency audio
   security.rtkit.enable = true;
 
-  # Sound server
+  # PipeWire sound server
   services.pipewire = {
     enable = true;
 
-    # Enable components
+    # Enable ALSA, PulseAudio compatibility, and WirePlumber session manager
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
+    wireplumber.enable = true;
   };
 
-  # Sound mixer
+  # Audio control utilities
   environment.systemPackages = with pkgs; [
     pulsemixer
   ];

nixos/fuchsia/services/default.nix

@@ -1,11 +1,11 @@
 {...}: {
   imports = [
     ./amdgpu-clocks
+    ./audio
     ./borgbackup
     ./flatpak
     ./internet-sharing
     ./libinput
-    ./pipewire
     ./printing
     ./snapper
     ./ssh