feat(darwin): enable declarative Homebrew on the macOS host

Turn on nix-darwin's homebrew module with empty taps/brews/casks/masApps lists to fill in, onActivation autoUpdate+upgrade, and cleanup=none (manual formulae left intact; flip to zap for fully authoritative lists). Set system.primaryUser so brew activation runs as the host user.

system/machine/Darwin/configuration.nix

@@ -2,11 +2,33 @@
 # (shell, git, editor) is carried by the shared ./lyrathorpe/home modules,
 # the same ones used by the Linux hosts. nixpkgs.hostPlatform is set by
 # mkDarwinHost in flake.nix.
-{ pkgs, ... }:
+{ pkgs, username, ... }:
 {
   programs.zsh.enable = true;
   environment.systemPackages = [ pkgs.git ];
 
+  # Account that runs user-level activation and Homebrew.
+  system.primaryUser = username;
+
+  # Declarative Homebrew for packages with no nixpkgs equivalent or that must be
+  # the vendor build (GUI casks, Mac App Store apps). Homebrew itself must already
+  # be installed:
+  #   /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+  homebrew = {
+    enable = true;
+    onActivation = {
+      autoUpdate = true;
+      upgrade = true;
+      # "none" leaves manually-installed formulae alone. Switch to "zap" to make
+      # the lists below fully authoritative (uninstalls anything not declared).
+      cleanup = "none";
+    };
+    taps = [ ];
+    brews = [ ];
+    casks = [ ];
+    masApps = { };
+  };
+
   # Used for backwards compatibility; read `darwin-rebuild changelog` before changing.
   system.stateVersion = 5;
 }