flake: split mediaserver onto nixos-25.11, keep desktops on unstable

The mediaserver kept hard-freezing on local builds (gnupg, openldap,
deno/rusty-v8) whenever a fresh unstable revision outran Hydra's
binary cache. It doesn't need bleeding-edge packages — every service
it runs is mature enough that 6-month-old versions are fine — so move
it onto the stable channel where the cache is essentially always
warm. Gaming and Macbook stay on unstable for fresh GPU/kernel work.

Implementation: add nixpkgs-stable + home-manager-stable inputs,
parameterise mkHost to accept a (nixpkgs, home-manager) pair.

Drive-by:
- Switch homepage.nix from environmentFiles (plural, unstable-only)
  to environmentFile (singular, present on both channels).
- Gate the openldap-skip-tests overlay to non-mediaserver hosts so
  it doesn't force a local rebuild on stable, where openldap is
  always cached.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/homepage.nix

@@ -118,7 +118,7 @@ in
       allowedHosts = "localhost:8082,127.0.0.1:8082,homepage.nordhammer.it";
 
       # API keys auto-extracted by homepage-extract-secrets.service
-      environmentFiles = [ "/etc/homepage-secrets" ];
+      environmentFile = "/etc/homepage-secrets";
 
       settings = {
         title = "FredOS Mediaserver";