fix: pin Flatpak to 1.16.6 to work around sandbox env leak bug

Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox,
breaking glycin-svg icon loading (e.g. OpenDeck). Pin services.flatpak.package
to a nixpkgs-flatpak input locked to a revision with Flatpak 1.16.6, scoped
to the Flatpak service only, until flatpak/flatpak#6721 lands in nixpkgs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

modules/services/flatpak.nix

@@ -1,7 +1,15 @@
+{ inputs, pkgs, ... }:
+
 {
   services.flatpak = {
     enable = true;
 
+    # TEMPORARY: pin Flatpak itself to 1.16.6 via nixpkgs-flatpak (see flake.nix).
+    # Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox and breaks
+    # glycin-svg icon loading (e.g. OpenDeck). Remove once
+    # https://github.com/flatpak/flatpak/issues/6721 lands in nixpkgs.
+    package = inputs.nixpkgs-flatpak.legacyPackages.${pkgs.system}.flatpak;
+
     remotes = [
       {
         name = "flathub";