paseo: Restart always + StartLimitIntervalSec=0; pay.nix (local state)

hosts/heather/paseo.nix

@@ -48,8 +48,9 @@
       ExecStart = "/home/mikl/.npm-global/bin/paseo daemon start --foreground --no-web-ui --no-relay";
       EnvironmentFile = "/var/lib/paseo-secrets/paseo.env";
       WorkingDirectory = "/home/mikl";
-      Restart = "on-failure";
+      Restart = "always";
       RestartSec = 5;
+      StartLimitIntervalSec = 0;
     };
   };
 }

hosts/heather/pay.nix

@@ -0,0 +1,38 @@
+# pay — official Solana Foundation CLI for x402 / MPP payments.
+# Source: https://github.com/solana-foundation/pay (upstream prebuilt binaries).
+# Аналог ~/.config/nix/home/pay.nix на poppy (nix-darwin). Нужен pi-агентам
+# (тулза exa_search платит за вызовы через pay; без него spawn pay ENOENT).
+{ stdenv, fetchurl, lib, autoPatchelfHook, openssl }:
+let
+  version = "0.21.0";
+  tag = "pay-v${version}";
+in
+stdenv.mkDerivation {
+  pname = "pay";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/solana-foundation/pay/releases/download/${tag}/pay-x86_64-unknown-linux-gnu.tar.gz";
+    sha256 = "1vyf5pw4j7phyffa1aw66ms2j3r983qjj47wlsiyi0sdmwvzy9pi";
+  };
+
+  sourceRoot = ".";
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [ openssl stdenv.cc.cc.lib ];
+  dontConfigure = true;
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 pay $out/bin/pay
+    runHook postInstall
+  '';
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "Solana Foundation CLI for x402 / MPP agentic API payments";
+    homepage = "https://pay.sh/";
+    license = lib.licenses.mit;
+    mainProgram = "pay";
+  };
+}