refactor(browsers): consolidate all browser modules under modules/browsers/

[Bad3r]

Why

Browser configuration is currently scattered across two generic namespaces — modules/apps/ (NixOS-level) and modules/hm-apps/ (Home Manager-level) — alongside unrelated apps. The Gecko family already grew a shared helper (modules/hm-apps/_gecko-browser-common.nix) during #124/#125, and a Chromium-family counterpart is a natural next step. Consolidating every browser under a dedicated modules/browsers/ tree (mirroring the modules/agents/ pattern) gives the browser surface one canonical home, makes cross-browser helpers discoverable, and keeps per-browser NixOS + Home Manager wiring side by side.

This issue is the parent tracker for the layout move. Per-browser configuration refactors (e.g. Firefox-family shared settings/search/containers in #124) remain separate child issues.

Current layout

Gecko family:

NixOS module (flake.nixosModules.apps.*)	Home Manager module (flake.homeManagerModules.apps.*)
modules/apps/firefox.nix	modules/hm-apps/firefox.nix
modules/apps/floorp.nix	modules/hm-apps/floorp.nix
modules/apps/librewolf.nix	modules/hm-apps/librewolf.nix

Chromium family:

NixOS module	Home Manager module
modules/apps/brave.nix	(none — Brave is intentionally NixOS-only)
modules/apps/brave-origin.nix	(none — brave-origin is intentionally NixOS-only; backed by the local packages/brave-origin/ derivation, retirement tracked in #127)
modules/apps/google-chrome.nix	modules/hm-apps/google-chrome.nix
modules/apps/ungoogled-chromium.nix	modules/hm-apps/ungoogled-chromium.nix

Shared helpers (underscore-prefixed, not auto-discovered):

• modules/hm-apps/_gecko-browser-common.nix
• modules/hm-apps/_librewolf-ubo-default-lists.json

Target layout

Per-browser subdirectory, mirroring modules/agents/codex/:

modules/browsers/
├── _gecko-common.nix
├── _librewolf-ubo-default-lists.json
├── firefox/
│   ├── apps.nix       # was modules/apps/firefox.nix
│   └── home.nix       # was modules/hm-apps/firefox.nix
├── floorp/
│   ├── apps.nix
│   └── home.nix
├── librewolf/
│   ├── apps.nix
│   └── home.nix
├── brave/
│   └── apps.nix       # Brave is intentionally NixOS-only
├── brave-origin/
│   └── apps.nix       # was modules/apps/brave-origin.nix — local packages/brave-origin/ retired once nixpkgs#511131 lands (#127)
├── google-chrome/
│   ├── apps.nix
│   └── home.nix
└── ungoogled-chromium/
    ├── apps.nix
    └── home.nix

Rationale: keeps NixOS and Home Manager surfaces visually separated per browser, leaves room for future per-browser helpers (e.g. firefox/_policies.nix) without cluttering the top level, and matches how modules/agents/codex/ organises multi-file agents.

Namespace

Browser modules move to a dedicated browsers.<name> namespace:

• flake.nixosModules.apps.<name> → flake.nixosModules.browsers.<name>
• flake.homeManagerModules.apps.<name> → flake.homeManagerModules.browsers.<name>

Host compositions (modules/system76/home-manager-apps.nix, modules/tpnix/home-manager-apps.nix, and any NixOS-level counterparts) must be updated to pull each browser from the new namespace.

Child issues / related work

• refactor(browsers): share Firefox-family base config #124 — refactor(browsers): share Firefox-family base config. Partially addressed by feat(librewolf): enable LibreWolf with shared Gecko browser config #125 (shared extensions, policies, uBO defaults, LibreWolf HM module). Remaining scope: shared profile settings, WebRTC/DRM option surface, search engines, containers, apply shared prefs to LibreWolf.
• Follow-up to file after this issue lands:
  • Chromium-family shared base (counterpart to _gecko-common.nix for Brave / Chrome / Ungoogled Chromium policies and extension declarations).

Acceptance criteria

• Every file listed in Current layout has moved under modules/browsers/ following the Target layout above.
• Shared helpers (_gecko-common.nix, _librewolf-ubo-default-lists.json) live at the top of modules/browsers/ and remain underscore-prefixed so auto-discovery ignores them.
• Module namespaces are migrated: every browser registers under flake.nixosModules.browsers.<name> / flake.homeManagerModules.browsers.<name>.
• Host compositions (modules/system76/home-manager-apps.nix, modules/tpnix/home-manager-apps.nix, and any NixOS-level counterparts) resolve every browser from the new browsers.* namespace.
• The CI workflow that refreshes _librewolf-ubo-default-lists.json (.github/workflows/update-librewolf-ubo-lists.yml, .github/scripts/update-librewolf-ubo-lists.sh) is updated to point at the new path.
• nix flake check --accept-flake-config --no-build --offline passes.
• Host closures build for both system76 and tpnix.
• No behavioural change: same browser package, same policies, same extensions/settings. Parent issue is layout + namespace only.

Out of scope

• Any per-browser configuration refactor (profile settings, search engines, containers, bookmarks, WebRTC/DRM option surface unification). Those belong to refactor(browsers): share Firefox-family base config #124 and any new Chromium-family counterpart issue filed after this one lands.

Notes

• Dendritic/import-tree auto-discovery means file path moves do not require touching other modules — but the namespace migration does require updating every consumer (host composition lists and any other references to flake.*Modules.apps.<browser>).
• Underscore-prefixed files stay private (not auto-imported) — the shared helpers must keep that prefix after the move.
• The modules/agents/ tree is the reference pattern: top-level entry .nix files, subdirectories for multi-file agents, and underscore-prefixed helpers live inside the subdirectory.