Remove unused lieer, add silent periodic mbsync timer; bump azos-core

lieer was declared (programs/services.lieer.enable) but had zero real
footprint — mu4e actually fetches via mbsync (mu4e-get-mail-command is
literally "mbsync -a") and sends via msmtp; lieer never had an auth/sync
state file anywhere. Drop it to stop the config suggesting a sync path
that isn't actually in use.

Add a systemd user timer that runs mbsync every 5 minutes. mbsync's
PassCmd shells out to `pass`, which needs the GPG smartcard; on a blind
timer a missing card would otherwise surface as a pinentry "please
insert card" prompt every run. The wrapper script gates the sync behind
`gpg --card-status`, which only queries the reader without invoking
pinentry either way, so a missing card is now a silent no-op instead of
a nag.

Bump azos-core for EDNC popup notifications.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

features/mail/default.nix

@@ -25,6 +25,17 @@
         certificatesFile = "/etc/ssl/certs/ca-certificates.crt";
       };
     };
+    # mbsync's PassCmd shells out to `pass`, which needs the GPG smartcard to
+    # decrypt. On a timer, a missing card would otherwise surface as a
+    # pinentry "please insert card" prompt every run. `gpg --card-status`
+    # only queries the card reader (no pinentry involved either way), so it's
+    # safe to use as a silent presence check: skip the sync entirely when the
+    # card isn't there, instead of letting mbsync hit that prompt.
+    mbsyncSafe = pkgs.writeShellScript "mbsync-safe" ''
+      if ${pkgs.gnupg}/bin/gpg --card-status >/dev/null 2>&1; then
+        exec ${pkgs.isync}/bin/mbsync -a
+      fi
+    '';
   in {
     options.azos.mail.enable = lib.mkOption {
       default = true;
@@ -35,7 +46,6 @@
         mu.enable = true;
         mbsync.enable = true;
         msmtp.enable = true;
-        lieer.enable = true;
       };
       home.activation.muInit = lib.hm.dag.entryAfter ["writeBoundary"] ''
         if [ ! -d "$HOME/.cache/mu" ]; then
@@ -46,7 +56,6 @@
             --my-address=anerz@post.bgu.ac.il
         fi
       '';
-      services.lieer.enable = true;
       accounts.email.accounts = {
         gmail =
           default_gmail_params
@@ -78,6 +87,21 @@
             passwordCommand = "pass privateemail.com | head -1";
           };
       };
+      systemd.user.services.mbsync-timer = {
+        Unit.Description = "Sync mail via mbsync (skips silently if smartcard is absent)";
+        Service = {
+          Type = "oneshot";
+          ExecStart = "${mbsyncSafe}";
+        };
+      };
+      systemd.user.timers.mbsync-timer = {
+        Unit.Description = "Periodic mbsync mail sync";
+        Timer = {
+          OnStartupSec = "2m";
+          OnUnitActiveSec = "5m";
+        };
+        Install.WantedBy = ["timers.target"];
+      };
     };
   };
 }