switch default shell to zsh and adopt catppuccin mocha

modules/home/shell/zsh.nix

@@ -0,0 +1,136 @@
+{ config, ... }:
+{
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    dotDir = config.home.homeDirectory;
+
+    oh-my-zsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "sudo"
+      ];
+    };
+
+    shellAliases.ssh = "kitten ssh";
+
+    profileExtra = ''
+      if [[ -x /opt/homebrew/bin/brew ]]; then
+        eval "$(/opt/homebrew/bin/brew shellenv)"
+      elif [[ -x /usr/local/bin/brew ]]; then
+        eval "$(/usr/local/bin/brew shellenv)"
+      fi
+
+      [[ -r "$HOME/.orbstack/shell/init.zsh" ]] && source "$HOME/.orbstack/shell/init.zsh"
+    '';
+
+    initContent = ''
+      typeset -U path PATH
+      path=(
+        "$HOME/.cache/.bun/bin"
+        "$HOME/.local/bin"
+        $path
+        "$HOME/.lmstudio/bin"
+      )
+      export PATH
+
+      _load_global_secrets() {
+        local secret_dir="''${XDG_CONFIG_HOME:-$HOME/.config}/secrets/global-env"
+        local secret_file name value
+
+        [[ -d "$secret_dir" ]] || return 0
+
+        for secret_file in "$secret_dir"/*(N.); do
+          name="''${secret_file:t}"
+          [[ "$name" =~ '^[A-Za-z_][A-Za-z0-9_]*$' ]] || continue
+          value="$(<"$secret_file")"
+          export "$name=$value"
+        done
+      }
+
+      _load_global_secrets
+      unfunction _load_global_secrets
+
+      dotfiles-qa() (
+        local dotfiles_dir="${config.home.homeDirectory}/Development/dotfiles"
+
+        print -P "%F{green}Running dotfiles QA validation...%f"
+        cd "$dotfiles_dir" || return 1
+
+        print -P "%F{blue}1. Formatting Nix files...%f"
+        nix fmt . || {
+          print -P "%F{red}Formatting failed.%f"
+          return 1
+        }
+
+        print -P "%F{blue}2. Running flake checks...%f"
+        XDG_CACHE_HOME="$dotfiles_dir/.cache" nix flake check || {
+          print -P "%F{red}Flake checks failed.%f"
+          return 1
+        }
+
+        print -P "%F{blue}3. Building the Darwin configuration...%f"
+        darwin-rebuild build --flake "$dotfiles_dir#macbook-pro" || {
+          print -P "%F{red}Darwin build failed.%f"
+          return 1
+        }
+
+        print -P "%F{green}Core QA checks passed.%f"
+      )
+
+      bd-init() {
+        if [[ ! -d .git && ! -f .git ]]; then
+          print -P "%F{red}Error: not in a Git repository.%f"
+          print "Initialize one with: git init"
+          return 1
+        fi
+
+        if [[ -e .beads ]]; then
+          print -P "%F{yellow}Beads is already initialized in this project.%f"
+          return 0
+        fi
+
+        bd init || return
+        print -P "%F{green}Beads initialized.%f"
+        print "Next steps:"
+        print '  bd create --title "Your task" --type feature'
+        print "  bd ready"
+      }
+
+      bd-ready() {
+        if [[ ! -e .beads ]]; then
+          print -P "%F{red}Not a Beads project. Run bd-init first.%f"
+          return 1
+        fi
+
+        local ready_tasks
+        ready_tasks="$(bd ready --json)" || return
+
+        if [[ "$(print -r -- "$ready_tasks" | jq 'length')" == 0 ]]; then
+          print -P "%F{yellow}No ready tasks.%f"
+          return 0
+        fi
+
+        print -P "%F{green}Ready tasks:%f"
+        print -r -- "$ready_tasks" | jq -r '
+          .[] |
+          "[\(.id)] \(.title)\n  Type: \(.type) | Priority: \(.priority) | Status: \(.status)" +
+          (if ((.description // "") | length) > 0 then "\n  \(.description)" else "" end) +
+          "\n"
+        '
+      }
+
+      bd-sync() {
+        if [[ ! -e .beads ]]; then
+          print -P "%F{red}Not a Beads project.%f"
+          return 1
+        fi
+
+        print -P "%F{blue}Syncing Beads database...%f"
+        bd sync || return
+        print -P "%F{green}Sync complete.%f"
+      }
+    '';
+  };
+}