fix(kodi): use qt-pinned for stremio to avoid qtwebengine rebuilds

- Add permittedInsecurePackages to qt-pinned config in flake.nix
- Use qt-pinned.stremio instead of pkgs.stremio
- Update warning message to reference nixpkgs-qt

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

flake.nix

@@ -80,7 +80,10 @@
       # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
       qt-pinned = import inputs.nixpkgs-qt {
         system = prev.stdenv.hostPlatform.system;
-        config.allowUnfree = true;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
       };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable

roles/kodi/default.nix

@@ -80,12 +80,12 @@ in
         firefox
         jellyfinMediaPlayerPkg
         kodiPkg
-        stremio
+        qt-pinned.stremio
         wget
       ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
 
       nixpkgs.config.permittedInsecurePackages = lib.warn
-        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player dependency. Remove this once jellyfin is updated to use qt6"
+        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency. These are pinned to nixpkgs-qt to avoid rebuilds - update that input separately when you have time."
         [
           "qtwebengine-5.15.19"
         ];