Replace Throne with Clash Verge

[martrtr]

What changed

• replace Throne with the NixOS-native Clash Verge Rev package and privileged service mode
• remove the custom Throne compatibility override and programs.throne installation
• seed an editable Clash Verge local Mihomo profile for root@194.87.97.119
• route Russian resources directly while sending known blocked Russian domains/IPs and other TCP traffic through SSH
• reject QUIC so browsers fall back to TCP; keep other UDP direct because Mihomo's SSH outbound is TCP-only
• autostart Clash Verge after the iNiR theme application service
• place the Clash Verge GUI on workspace 8, matching the old Throne placement

Secrets

No private key is committed. The seeded profile references /home/mart/.ssh/id_ed25519. Clash Verge owns the seeded profile files after first activation, so later GUI edits remain mutable.

Validation

The PR workflow reaches nix flake check, but the repository's current main already fails the same check before this PR: evaluation trips over the existing iNiR builtins.pathExists logic under --no-build (bash-interactive-5.3p15.drv is not valid). The latest main workflow for base commit 6aa8df81... is also red, so this is a pre-existing CI blocker rather than a Clash Verge failure.

[martrtr]

replace throne with clash verge