refactor(fuchsia): reorganize audio and bluetooth configuration

Separated PipeWire audio configuration from bluetooth hardware settings for
better logical organization. Moved bluetooth config to hardware-configuration.nix
alongside kernel module workarounds (disable_ertm, iwlwifi power_save).

Also added documentation for permittedInsecurePackages in global config and
updated flake dependencies.

nixos/fuchsia/services/audio/default.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }: {
+  # Realtime scheduler for low-latency audio
+  security.rtkit.enable = true;
+
+  # PipeWire sound server
+  services.pipewire = {
+    enable = true;
+
+    # Enable ALSA, PulseAudio compatibility, and WirePlumber session manager
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    wireplumber.enable = true;
+  };
+
+  # Audio control utilities
+  environment.systemPackages = with pkgs; [
+    pulsemixer
+  ];
+}