feat(darwin): optimise storage + move GUI apps to Homebrew; refactor secrets & Cloudflare setup
- Enable min-free/max-free and disable keep-outputs/keep-derivations on macOS
- Reduce GC retention to 14d on 256GB Mac
- Exclude heavy dev packages (ollama, dotnet-sdk, openjdk21) from darwin
- Move GUI apps to Homebrew casks with clearer categorisation
- Remove DuckDNS secret + activation logic
- Refactor Cloudflare tunnel script (Python-based tunnelId update, DNS upsert)
- Encrypt cf-tunnel.json and claude.json with sops
- Allow secrets/cloudflare.token in .gitignore
- Bump version to v0.3.1 and update flake.lock