feat(home-assistant): add ha-sourdough custom component

Package the Sourdough Monitor HACS component declaratively via
buildHomeAssistantComponent (pinned to v1.1.3), avoiding a HACS
runtime. Config-flow based, so it's added through the HA UI after
rebuild. No external pip deps; requires HA >= 2026.3.0 (have 2026.5.4).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NHApfYHvEmVLpsqkXdx4oq

machines/mibook/configuration.nix

@@ -10,7 +10,6 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
-    ./network.nix
     # ./system.nix use docker here
   ];
 

machines/mibook/network.nix

@@ -1,8 +0,0 @@
-_: {
-  # Athena (local AI): allow LAN access to the Hermes web dashboard.
-  # Bound to 0.0.0.0:9119 in the athena docker stack; NixOS default-deny
-  # firewall otherwise blocks inbound connections from other devices.
-  networking.firewall.allowedTCPPorts = [
-    9119 # athena hermes dashboard
-  ];
-}

modules/environments/home-assistant/default.nix

@@ -23,6 +23,23 @@ in
     services.home-assistant = {
       enable = true;
       openFirewall = true;
+
+      # HACS-style custom components, packaged declaratively (no HACS runtime).
+      # Config-flow based: add via Settings > Devices & Services after rebuild.
+      customComponents = [
+        (pkgs.buildHomeAssistantComponent {
+          owner = "Matts-Baps";
+          domain = "sourdough";
+          version = "1.1.3";
+          src = pkgs.fetchFromGitHub {
+            owner = "Matts-Baps";
+            repo = "ha-sourdough";
+            rev = "v1.1.3";
+            hash = "sha256-Uoid/2f6GxZMuE5Keu2VjHPYuOxnYG8hsCD6BYcaTvM=";
+          };
+        })
+      ];
+
       extraComponents = [
         "matter"
         "mobile_app"