tuwunel v1.9.3 (DB migrated, verified); teable mem_limit 2g; nick-timer systemd service + caddy vhost; heather swap 4g, drop chromium, add diag tools; server.nix: drop pinchtab, add nodejs

hosts/heather/default.nix

@@ -21,17 +21,31 @@
     ./syncthing.nix       # sync + relay
     ./tuwunel-admin.nix   # matrix admin web UI (systemd, статический бинарник)
     ./paseo.nix           # paseo daemon (web UI для CLI-агентов, systemd + npm global)
+    ./nick.nix            # Nick timer prototype (systemd, localhost:8787)
     ./jupyter.nix         # JupyterLab (systemd, localhost:8890, лимиты)
     ./mesh-clients.nix    # Sol-style client pool (wg-clients1)
     ./mesh-egress.nix     # Sol-style selected-destination egress policy
   ];
 
+  # Heather has 8 GiB RAM and runs several containers. Keep a 4 GiB
+  # swapfile so a transient application spike does not take down the host.
+  swapDevices = [
+    {
+      device = "/var/swapfile";
+      size = 4096;
+    }
+  ];
+
   # First server-to-server WireGuard backbone link: heather ↔ hyacinth.
   # The private key is generated on the live host and stays outside the flake.
-  # Chromium для PinchTab: отдельный headless-браузер для agent automation.
-  environment.systemPackages = [
-    pkgs.wireguard-tools
-    pkgs.chromium
+  # Basic diagnostics/admin tools must be available even in non-login SSH
+  # sessions (and not depend on a stale Home Manager profile).
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+    tmux
+    jq
+    wget
+    python3
   ];
 
   # NixOS uses scripted networking here (not systemd-networkd), so create the