docs: fold todo.md items into the roadmap

Theme-switch progress feedback; per-theme icon themes (unblocks rofi
show-icons); starship prompt + modern-CLI aliases (bat/eza/rg/fd/zoxide);
opt-out default app suite (nomarchy.apps.*); Plymouth logo contrast fix;
hibernate double-unlock (hyprlock redundant after LUKS resume); plus a
keybindings-cheatsheet menu module and the SUPER+Space / SUPER+M binds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -271,12 +271,15 @@ close · `SUPER+1..9` workspaces · `Print` region screenshot.
     (qalc, copy/chain) · `files` (fd → xdg-open) · `web` (DuckDuckGo).
     SUPER+D is `rofi -show drun`.
   - next modules: Network ▸ nmtui · Bluetooth ▸ blueman · Capture ▸
-    screenshot · **ask Claude**: free-text → `$TERMINAL -e claude
+    screenshot · **keybindings cheatsheet** (parse the bind list → rofi,
-    "<question>"` — the claude CLI auths via OAuth against a Pro/Max
+    so SUPER-? shows every shortcut) · **ask Claude**: free-text →
-    subscription (no API key); REPL stays open for follow-ups (claude-code
+    `$TERMINAL -e claude "<question>"` — the claude CLI auths via OAuth
-    in nixpkgs is unfree — allowUnfree is on)
+    against a Pro/Max subscription (no API key); REPL stays open for
-  - launcher icons: `show-icons` is off (no icon theme shipped yet);
+    follow-ups (claude-code in nixpkgs is unfree — allowUnfree is on)
-    enabling it well means shipping an icon theme (Papirus/Adwaita)
+  - planned binds: `SUPER+Space` → `rofi -dmenu`/quick-launch and
+    `SUPER+M` → `nomarchy-menu` (main menu); `SUPER+D` stays `-show drun`
+  - launcher icons: `show-icons` is off until the icon-theme item below
+    lands (rofi needs an installed icon theme to show app icons)
   - decision record: resolves the old Walker/Lua question — no GTK4
     launcher, no second theming pipeline; the dispatcher owns the menu
     structure, so the renderer stays swappable (we moved fuzzel → rofi 2.0
@@ -306,3 +309,32 @@ close · `SUPER+1..9` workspaces · `Print` region screenshot.
   screen, tuigreet/MOTD text, and the `distroId` question (it changes
   `DEFAULT_HOSTNAME` and upstream `isNixos` checks — needs a test pass;
   nixos-* CLI names stay regardless)
+- **Theme-switch feedback:** a switch runs `home-manager switch` (seconds
+  to minutes), and today the only signal is the notify-send toast
+  ("Applying theme — rebuilding…"). Add a visible progress indicator so a
+  slow switch never reads as a failed selection — e.g. a spinner/progress
+  widget from `nomarchy-theme-sync` (it already brackets the rebuild) or a
+  Waybar/swaync element while the switch runs.
+- **Icon themes:** add `icon` to `theme-state.json`, have Stylix/GTK and
+  rofi (`show-icons`) consume it, and ensure the chosen icon theme is
+  pulled into the closure per active theme (a dark/light pair, e.g.
+  Papirus-Dark/Light, picked to match `mode`). Unblocks rofi launcher
+  icons and tidies Thunar/GTK app icons.
+- **Nicer shell out of the box:** ship and default-configure a prompt
+  (starship, themed from the JSON) plus modern-CLI ergonomics —
+  `bat`→cat, `eza`→ls, `ripgrep`→grep, `fd`→find, `zoxide`→cd — wired as
+  aliases/`$PAGER` so the terminal is pleasant by default (overridable).
+- **Default application suite:** install a complete-workstation set
+  (vscode, libreoffice, gimp, inkscape, texlive-full, …) behind a
+  `nomarchy.apps.*` option surface so each is individually opt-out for
+  users who want a leaner machine. Watch closure size (texlive-full is
+  multi-GB — likely default-off or a lighter scheme).
+- **Plymouth logo contrast:** the shipped splash logo is too dark against
+  the dark `base` background; recolor/lighten it (or tint from the palette
+  `accent`/`text` instead of shipping a fixed navy asset) so it reads on
+  both light and dark themes.
+- **Hibernate double-unlock:** on resume from hibernate the LUKS
+  passphrase already gates the machine, but hypridle's `before_sleep_cmd`
+  also locks hyprlock, so the user types a password twice. Lock only on
+  suspend (not hibernate), or skip the hyprlock prompt when resuming from
+  a LUKS-encrypted hibernate — see `modules/home/idle.nix`.