refactor(nix): order let bindings

configs/nixos/modules/desktop/apps/firefox.nix

@@ -8,8 +8,8 @@
 # Firefox as the desktop browser: stock mainline, hardened and de-monetized by policy.
 let
   cfg = config.modules.desktop.apps.firefox; # NOLINT(let_order)
-  user = config.user.name;
   firefoxAddons = inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system};
+  user = config.user.name;
 in
 {
   options.modules.desktop.apps.firefox = {

configs/nixos/modules/desktop/session/hyprland/default.nix

@@ -7,7 +7,6 @@
 # The Hyprland compositor.
 let
   cfg = config.modules.desktop.session.hyprland; # NOLINT(let_order)
-  user = config.user.name;
   cursor = config.stylix.cursor;
 
   # Numbered-workspace switch and move for 1..9, the operator's i3 muscle memory.
@@ -16,6 +15,8 @@ let
     "$mod SHIFT, ${toString n}, movetoworkspace, ${toString n}"
   ]) (lib.range 1 9);
 
+  user = config.user.name;
+
   # Flip the tiling strategy between the two built-in layouts, since neither a
   # dispatcher nor a keyword toggles it on its own.
   toggleLayout = pkgs.writeShellScript "hypr-toggle-layout" ''

configs/nixos/modules/desktop/session/hyprland/hypridle.nix

@@ -7,14 +7,15 @@
 # hypridle: idle-triggered locking and display power management.
 let
   cfg = config.modules.desktop.session.hyprland.hypridle; # NOLINT(let_order)
+
+  # The guard drops the call when a locker is already up, so no idle trigger
+  # stacks a second hyprlock over the first.
+  lockCmd = "${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}";
   user = config.user.name;
 
   hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";
   hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
 
-  # The guard drops the call when a locker is already up, so no idle trigger
-  # stacks a second hyprlock over the first.
-  lockCmd = "${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}";
 in
 {
   options.modules.desktop.session.hyprland.hypridle = {

configs/nixos/modules/desktop/session/waybar.nix

@@ -8,11 +8,12 @@
 let
   cfg = config.modules.desktop.session.waybar; # NOLINT(let_order)
   vpnClient = config.modules.network.vpn-client;
-  user = config.user.name;
 
   # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
   # through JSON so the glyph survives as bytes rather than an editor paste.
   g = code: builtins.fromJSON ''"\u${code}"'';
+  user = config.user.name;
+
   sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
 
   # Renders and toggles mako's do-not-disturb mode.

configs/nixos/modules/desktop/utilities/theming.nix

@@ -7,7 +7,6 @@
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
   cfg = config.modules.desktop.utilities.theming; # NOLINT(let_order)
-  user = config.user.name;
 
   # A single static Nord wallpaper, drawn as a vertical gradient across the
   # Polar Night shades so it needs no committed binary and no network fetch.
@@ -16,6 +15,7 @@ let
       -size 2560x1440 gradient:'#2E3440'-'#3B4252' \
       "$out"
   '';
+  user = config.user.name;
 in
 {
   options.modules.desktop.utilities.theming.enable =