feat(nixos): disk hygiene, dedupe shared options, fix MacPro docs

- common-nixos: nix.settings.auto-optimise-store + larger download buffer.
- workstation: fstrim, boot.tmp.cleanOnBoot, and the shared graphical
  options moved here from the per-host configs (pipewire, swaylock PAM
  stub, redistributable firmware) -- MBP-Asahi gains audio it lacked.
- T400: zramSwap for the low-RAM host.
- MBP-Asahi: nixos-apple-silicon binary cache substituter.
- MacPro31 README: describe the real (LVM/UUID) hardware config; it is no
  longer a placeholder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

system/modules/workstation.nix

@@ -14,4 +14,24 @@
   # Default-deny inbound. Hosts that run a listening service open their own
   # ports next to where the service is enabled (e.g. sshd -> 22 on X1).
   networking.firewall.enable = true;
+
+  # Disk hygiene for the physical hosts. fstrim reclaims unused SSD blocks on a
+  # weekly timer; cleanOnBoot wipes /tmp at every boot.
+  services.fstrim.enable = true;
+  boot.tmp.cleanOnBoot = true;
+
+  # Audio. PipeWire with the PulseAudio shim covers every graphical host; no
+  # per-machine audio config is needed.
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+
+  # swaylock PAM stack. None of these machines has working fingerprint auth, so
+  # an empty service is enough -- swaylock falls back to password.
+  security.pam.services.swaylock = { };
+
+  # Redistributable firmware (GPU/Wi-Fi/NIC blobs) for the x86 hosts. Harmless
+  # on the Asahi MBP, which supplies its own peripheral firmware out-of-band.
+  hardware.enableRedistributableFirmware = true;
 }