turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

hosts/freun-dev/services.nix

@@ -120,6 +120,7 @@ in
           user = smtp.username;
           from_address = smtp.from;
         };
+        security.secret_key = "$__file{${secrets."grafana/secret-key".path}}";
       };
     };
 
@@ -327,14 +328,6 @@ in
       subdomain = "irc";
     };
 
-    sillytavern = {
-      enable = true;
-      subdomain = "st";
-      listen = true;
-      whitelist = false;
-      port = 3100;
-    };
-
     nginx.virtualHosts."isarepomaa.com" = {
       forceSSL = true;
       enableACME = true;