fix(kodi): use qt-pinned for stremio to avoid qtwebengine rebuilds

- Add permittedInsecurePackages to qt-pinned config in flake.nix
- Use qt-pinned.stremio instead of pkgs.stremio
- Update warning message to reference nixpkgs-qt

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

flake.nix

@@ -80,7 +80,10 @@
       # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
       qt-pinned = import inputs.nixpkgs-qt {
         system = prev.stdenv.hostPlatform.system;
-        config.allowUnfree = true;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
       };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable