feat(nixos): disk hygiene, dedupe shared options, fix MacPro docs

- common-nixos: nix.settings.auto-optimise-store + larger download buffer.
- workstation: fstrim, boot.tmp.cleanOnBoot, and the shared graphical
  options moved here from the per-host configs (pipewire, swaylock PAM
  stub, redistributable firmware) -- MBP-Asahi gains audio it lacked.
- T400: zramSwap for the low-RAM host.
- MBP-Asahi: nixos-apple-silicon binary cache substituter.
- MacPro31 README: describe the real (LVM/UUID) hardware config; it is no
  longer a placeholder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

system/machine/MacPro31/configuration.nix

@@ -27,19 +27,9 @@
   services.openssh.enable = true;
   networking.firewall.allowedTCPPorts = [ 22 ];
 
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-  };
-
-  # No fingerprint hardware; empty service still lets swaylock authenticate via
-  # password.
-  security.pam.services.swaylock = { };
-
-  # Dual Harpertown Xeon microcode + redistributable firmware (e.g. GPU/NIC
-  # blobs).
+  # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
+  # enabled in workstation.nix.
   hardware.cpu.intel.updateMicrocode = true;
-  hardware.enableRedistributableFirmware = true;
 
   # GPU note: the stock card varies between units -- ATI Radeon HD 2600 XT or
   # NVIDIA GeForce 8800 GT. Sway needs a working KMS/modesetting driver; do NOT