heather/common: passwordless sudo for mikl + fix deprecated options

- common/default.nix: add mikl to wheel + security.sudo.wheelNeedsPassword=false.
  Without this, root is unreachable on a fresh NixOS-yc image (no root password,
  no rescue channel) — nixos-rebuild switch is impossible. Mirrors the
  NOPASSWD:ALL that old YC boxes got via cloud-config user-data.
- home/server.nix: programs.git.extraConfig -> .settings, programs.git.delta
  -> programs.delta with enableGitIntegration=true (deprecated warnings).
- image.nix: boot.loader.grub.timeout -> boot.loader.timeout (renamed option).

home/cli.nix

@@ -36,6 +36,7 @@
     trash-cli       # rm с корзиной
     texliveFull     # LaTeX (~4GB, для математики)
     gita            # manage multiple git repos
+    ffmpeg_7        # видео-конвертация (remux/перекодирование)
   ];
 
   # TODO: global npm/pnpm packages not managed by nix for now

home/server.nix

@@ -74,13 +74,15 @@
     enable = true;
     userName = "mikl";
     userEmail = "mikl@iscg.dev";
-    extraConfig = {
+    settings = {
       init.defaultBranch = "main";
       pull.rebase = true;
       push.autoSetupRemote = true;
-      diff.pager = "delta";
     };
-    delta.enable = true;
+  };
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
   };
 
   # --- Zsh: минимульный, без pure-prompt и fastfetch (это десктоп-флёр) ---