nixos-module: use playwright's chromium-headless-shell instead of pkgs.chromium for PDF generation

snappdf only ever shells out to `$SNAPPDF_CHROMIUM_PATH --headless --print-to-pdf=...`,
so the full browser UI/GPU stack pkgs.chromium ships is unnecessary. Google's official
"Chrome for Testing" headless-only build (packaged by nixpkgs' playwright-driver,
selected via `browsers.override` with every other browser/ffmpeg disabled) does the
same job for a ~1.45GB smaller closure (431MB vs 1.88GB), needs no allowUnfree, and
PDF generation is noticeably faster in the VM test (~2.5s vs ~10s per request).

Drops the now-unnecessary allowUnfree wiring from the interactive VM and automated
test configs, which existed solely to build pkgs.chromium.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/nixos-test.nix

@@ -1,13 +1,7 @@
 { nixpkgsPath, system }:
 
 let
-  # nixosTest forbids setting `nixpkgs.config` on a node once `pkgs` is externally supplied,
-  # so allowUnfree (required to build pkgs.chromium) has to be baked into this pkgs instance
-  # up front rather than set from within common.nix like the interactive VM does.
-  pkgs = import nixpkgsPath {
-    inherit system;
-    config.allowUnfree = true;
-  };
+  pkgs = import nixpkgsPath { inherit system; };
 
   adminEmail = "admin@email.com";
   adminPassword = pkgs.lib.strings.trim (builtins.readFile ./invoice_ninja_test_password);