feat(apps): starter workstation app suite + steam/libvirt/obs services

The "default application suite" roadmap item, but deliberately NOT a
nomarchy.apps.* option surface: a bare package install has no config to
put behind a toggle, so a thin `mkIf x { systemPackages = [p]; }` only
reinvents what a package list already gives. Instead the suite is a
curated home.packages list in templates/downstream/home.nix (extending
the existing `# firefox` convention) — active staples (libreoffice,
vscode, gimp, inkscape, mpv, amberol) plus commented suggestions. The
opt-out is deleting a line; it also keeps the apps out of the live ISO
automatically (the ISO never scaffolds from the template).

The members that DO need system config become nomarchy.services.* opt-in
toggles instead (config behind the switch, like the existing services):
  - steam   → programs.steam (32-bit stack, controller udev, RP ports)
  - libvirt → libvirtd + virt-manager, login user added to libvirtd group
  - obs     → obs-studio + a v4l2loopback virtual camera (exclusive_caps=1)
              selectable as a webcam in Zoom/Teams

README option table, ROADMAP (services item now "Eight shipped"; suite
item marked done with the no-surface rationale) and the downstream
system.nix examples updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/home.nix

@@ -34,7 +34,36 @@
   # nomarchy.keyboard.layouts = [ "de" "fr" ]; # rofi-prompt for a layout when a
   #                                            # new keyboard connects + remember it
 
+  # ── Application suite ───────────────────────────────────────────────
+  # A starter complete-workstation set, installed for your user — yours to
+  # curate. Delete a line to slim the machine; uncomment a suggestion (or
+  # add your own) to extend it. The desktop itself — terminal, editor
+  # keybinds, theming — comes from the modules; these are the heavier
+  # standalone apps the distro doesn't impose by default.
+  #
+  # Gaming (Steam) and VMs (virt-manager) are NOT here — they need system
+  # setup beyond a package (32-bit libs, a daemon, group membership), so
+  # they're opt-in service toggles in system.nix instead
+  # (nomarchy.services.steam / nomarchy.services.libvirt).
   home.packages = with pkgs; [
-    # firefox
+    libreoffice-fresh   # office suite (documents, sheets, slides)
+    vscode              # code editor (unfree; allowUnfree is on)
+    gimp                # raster image editor
+    inkscape            # vector graphics
+    mpv                 # media player
+    amberol             # music player (local library; streaming → spotify below)
+
+    # ── Uncomment to add ──
+    # firefox               # a web browser (pick your own)
+    # thunderbird           # email client
+    # signal-desktop        # Signal messenger
+    # telegram-desktop      # Telegram
+    # zoom-us               # Zoom video calls (unfree)
+    # teams-for-linux       # Microsoft Teams (community client — no official Linux app)
+    # logseq                # notes / outliner (PKM)
+    # lmstudio              # local LLM runner (unfree; large closure)
+    # kdePackages.kdenlive  # non-linear video editor (pulls in KDE libs)
+    # spotify               # music streaming (unfree)
+    # texliveFull           # full LaTeX toolchain — multi-GB (texliveMedium is lighter)
   ];
 }

templates/downstream/system.nix

@@ -36,6 +36,9 @@
   # nomarchy.services.podman.enable = true;    # rootless containers (docker → podman)
   # nomarchy.services.flatpak.enable = true;   # Flatpak + the Flathub remote
   # nomarchy.services.pika.enable = true;      # Pika Backup (GUI Borg backups)
+  # nomarchy.services.steam.enable = true;     # Steam (32-bit libs, controllers, ports)
+  # nomarchy.services.libvirt.enable = true;   # libvirt/KVM + virt-manager GUI
+  # nomarchy.services.obs.enable = true;       # OBS Studio + v4l2loopback virtual camera
 
   system.stateVersion = "26.05";
 }