chore: flake update, pgbouncer SSL fix

overlays/default.nix

@@ -36,6 +36,17 @@
     };
   };
   # Flatten llm-agents packages into top-level pkgs namespace.
+  # Keep plain derivations only. llm-agents exports `buildNpmPackage` as an
+  # emptyDirectory derivation ("buildNpmPackage-guard") carrying a __functor
+  # that forwards to its OWN nixpkgs pin's builder. Flattening it would shadow
+  # nixpkgs' pkgs.buildNpmPackage and break unrelated packages — e.g.
+  # vaultwarden-webvault (npmDepsFetcherVersion = 3) failed with
+  # "fetchNpmDeps: fetcher version must be one of: 1, 2." because llm-agents'
+  # pinned fetchNpmDeps only allows 1 and 2. Real packages never have a
+  # __functor, so this filter drops such traps generically.
   mkLlmAgentsOverlay = system: _final: _prev:
-    inputs.llm-agents.packages.${system} or {};
+    inputs.nixpkgs.lib.filterAttrs (
+      _: v: inputs.nixpkgs.lib.isDerivation v && !v ? __functor
+    )
+    (inputs.llm-agents.packages.${system} or {});
 }