feat(apps): starter workstation app suite + steam/libvirt/obs services

The "default application suite" roadmap item, but deliberately NOT a
nomarchy.apps.* option surface: a bare package install has no config to
put behind a toggle, so a thin `mkIf x { systemPackages = [p]; }` only
reinvents what a package list already gives. Instead the suite is a
curated home.packages list in templates/downstream/home.nix (extending
the existing `# firefox` convention) — active staples (libreoffice,
vscode, gimp, inkscape, mpv, amberol) plus commented suggestions. The
opt-out is deleting a line; it also keeps the apps out of the live ISO
automatically (the ISO never scaffolds from the template).

The members that DO need system config become nomarchy.services.* opt-in
toggles instead (config behind the switch, like the existing services):
  - steam   → programs.steam (32-bit stack, controller udev, RP ports)
  - libvirt → libvirtd + virt-manager, login user added to libvirtd group
  - obs     → obs-studio + a v4l2loopback virtual camera (exclusive_caps=1)
              selectable as a webcam in Zoom/Teams

README option table, ROADMAP (services item now "Eight shipped"; suite
item marked done with the no-surface rationale) and the downstream
system.nix examples updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -138,11 +138,21 @@ how to override it. Items marked ✓ are shipped.
   tracks the palette), `ls`→eza, `cd`→zoxide, plus `lt`/`tree`.
   `nomarchy.shell.enable`. (Deliberately did NOT alias grep→rg / find→fd:
   their flags differ enough to surprise; `rg`/`fd` ship as themselves.)
-- **Default application suite:** install a complete-workstation set
-  (vscode, libreoffice, gimp, inkscape, texlive-full, …) behind a
-  `nomarchy.apps.*` option surface so each is individually opt-out for
-  users who want a leaner machine. Watch closure size (texlive-full is
-  multi-GB — likely default-off or a lighter scheme).
+- ✓ **Default application suite:** a starter complete-workstation set —
+  `libreoffice-fresh`, `vscode`, `gimp`, `inkscape` — ships *active* in the
+  downstream `templates/downstream/home.nix` `home.packages`, with the heavier
+  opt-ins (`texliveFull` — multi-GB; `texliveMedium` is lighter — plus
+  browser/email) commented just below. **Decision: no `nomarchy.apps.*` option
+  surface.** Unlike `nomarchy.services.*` (real config behind each toggle —
+  systemd units, subuid ranges, the Flathub oneshot), a bare package install
+  has nothing behind the toggle: `mkIf x { environment.systemPackages = [p]; }`
+  just reinholds what a package list already gives, and the honest opt-out for
+  a package is *deleting the line*. So the suite is the user's own curated list
+  (extending the existing `# firefox` convention), not a distro-module feature —
+  which also keeps the apps out of the live ISO automatically (it never starts
+  from the template) and respects that editor/office/graphics are personal-taste
+  choices, not defaults to impose. Unfree `vscode` evaluates fine — `mkFlake`
+  and the system both set `allowUnfree = true`.
 - ✓ **Plymouth logo contrast:** the shipped art was a fixed navy that
   vanished on dark bases. `modules/nixos/plymouth.nix` now recolors every
   element from the palette at build time (flat fill, alpha kept):
@@ -281,19 +291,24 @@ how to override it. Items marked ✓ are shipped.
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a
   downstream flips on in one line. Keeps the base lean while making common
-  additions trivial. **✓ Five shipped** in `modules/nixos/services.nix`
+  additions trivial. **✓ Eight shipped** in `modules/nixos/services.nix`
   (system-side), each with a commented example in the downstream `system.nix`
   template: `tailscale`, `syncthing` (runs as the login user, GUI on
   127.0.0.1:8384), `podman` (rootless, `docker` aliased, user subuid/subgid),
-  `flatpak` (+ Flathub remote added by a oneshot), `pika` (Pika Backup GUI).
-  More candidates by area:
+  `flatpak` (+ Flathub remote added by a oneshot), `pika` (Pika Backup GUI),
+  `steam` (`programs.steam` — the 32-bit stack, controller udev, Remote-Play
+  ports a bare package can't), `libvirt` (libvirtd + virt-manager, user added
+  to the `libvirtd` group), `obs` (OBS Studio + a v4l2loopback virtual camera
+  usable as a webcam in Zoom/Teams). More candidates by area:
   - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo)
-  - **local AI:** LM Studio (`lmstudio`); Ollama (`services.ollama`, optional
-    GPU accel) — pairs with the menu's Ask-Claude philosophy
-  - ✓ **containers/VMs:** Podman (`virtualisation.podman`); Docker / libvirt +
-    virt-manager (todo)
+  - **local AI:** LM Studio ships as a (commented) app-suite package — a bare
+    GUI, no service config; Ollama (`services.ollama`, optional GPU accel) is
+    the service still todo — pairs with the menu's Ask-Claude philosophy
+  - ✓ **containers/VMs:** Podman (`virtualisation.podman`); libvirt +
+    virt-manager (`nomarchy.services.libvirt`); Docker (todo)
   - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo)
-  - **gaming/media:** Steam (`programs.steam`); OBS Studio
+  - ✓ **gaming/media:** Steam (`nomarchy.services.steam`); OBS Studio
+    (`nomarchy.services.obs`, with the v4l2loopback virtual camera)
   - **devices:** printing (CUPS + Avahi); KDE Connect / phone integration;
     OpenRGB
   - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); restic/borg
@@ -303,9 +318,12 @@ how to override it. Items marked ✓ are shipped.
 
   Surface decided: `nomarchy.services.*`, system-side for system services
   (home-side ones can extend the same prefix later). Remaining: curate the
-  rest (Ollama, containers, Steam/OBS, printing, backups, Flatpak …) and
-  decide how it relates to `nomarchy.apps.*` (opt-out suite). Unfree entries
-  are already covered (`allowUnfree = true`).
+  rest (Ollama, containers, Steam/OBS, printing, backups, Flatpak …). The
+  opt-out application *suite* is deliberately **not** a parallel
+  `nomarchy.apps.*` surface — it's a curated `home.packages` list in the
+  downstream template (see "Default application suite" above), since a bare
+  package install has no config to put behind a toggle. Unfree entries are
+  already covered (`allowUnfree = true`).
 - ✓ **Display / monitor management:** declarative `nomarchy.monitors` (a
   per-output schema — name/resolution/position/scale/transform/mirror/
   bitdepth/vrr/disable) generates Hyprland `monitor` rules, keeping the