add agent-browser + BW browser auth sync for netty

- Add chromium to netty system packages
- Add home/agent-browser.nix: configures agent-browser to use nix
  chromium headless, installs via npm on first activation (Linux only)
- Add scripts/sync-bw-browser-auth.sh: imports all BW login items
  into agent-browser encrypted auth vault via --password-stdin
- Add just sync-browser-auth target

home/agent-browser.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  hostConfig,
+  ...
+}:
+lib.mkIf (!hostConfig.isDarwin) {
+  # agent-browser user-level config: point at nix chromium, run headless
+  home.file.".agent-browser/config.json".text = builtins.toJSON {
+    executablePath = "${pkgs.chromium}/bin/chromium";
+    args = "--no-sandbox,--disable-gpu,--disable-dev-shm-usage";
+  };
+
+  # Install agent-browser globally via npm at activation time
+  home.activation.installAgentBrowser = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    export PATH="${
+      lib.makeBinPath [
+        pkgs.nodejs_22
+        pkgs.coreutils
+      ]
+    }:$PATH"
+
+    if ! command -v agent-browser >/dev/null 2>&1; then
+      npm install -g agent-browser 2>/dev/null || true
+    fi
+  '';
+}

home/common.nix

@@ -3,6 +3,7 @@
   _module.args.theme = import ../lib/theme.nix { inherit config; };
 
   imports = [
+    ./agent-browser.nix
     ./bat.nix
     ./eza.nix
     ./claude.nix