fix: pin Flatpak to 1.16.6 to work around sandbox env leak bug

Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox,
breaking glycin-svg icon loading (e.g. OpenDeck). Pin services.flatpak.package
to a nixpkgs-flatpak input locked to a revision with Flatpak 1.16.6, scoped
to the Flatpak service only, until flatpak/flatpak#6721 lands in nixpkgs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.lock

@@ -265,6 +265,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-flatpak": {
+      "locked": {
+        "lastModified": 1781332575,
+        "narHash": "sha256-tyh5yzbIN2ftH+uilyTWR6WCMZQeh3m5iOowTLNodyk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "51effaf9783e0226281ad10e95a4af6c8a145316",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "51effaf9783e0226281ad10e95a4af6c8a145316",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1783475452,
@@ -347,6 +363,7 @@
         "nix-flatpak": "nix-flatpak",
         "nix-vscode-extensions": "nix-vscode-extensions",
         "nixpkgs": "nixpkgs_4",
+        "nixpkgs-flatpak": "nixpkgs-flatpak",
         "sidra": "sidra",
         "vscode-server": "vscode-server"
       }