heather/common: passwordless sudo for mikl + fix deprecated options

- common/default.nix: add mikl to wheel + security.sudo.wheelNeedsPassword=false.
  Without this, root is unreachable on a fresh NixOS-yc image (no root password,
  no rescue channel) — nixos-rebuild switch is impossible. Mirrors the
  NOPASSWD:ALL that old YC boxes got via cloud-config user-data.
- home/server.nix: programs.git.extraConfig -> .settings, programs.git.delta
  -> programs.delta with enableGitIntegration=true (deprecated warnings).
- image.nix: boot.loader.grub.timeout -> boot.loader.timeout (renamed option).

home/cli.nix

@@ -36,6 +36,7 @@
     trash-cli       # rm с корзиной
     texliveFull     # LaTeX (~4GB, для математики)
     gita            # manage multiple git repos
+    ffmpeg_7        # видео-конвертация (remux/перекодирование)
   ];
 
   # TODO: global npm/pnpm packages not managed by nix for now