feat: implement modular foundation and core system services

- Update flake.nix with 25.11 release and core inputs
- Add dedicated modules for audio (Pipewire), bluetooth, and networking
- Update GEMINI.md with the new Modular Merging Architecture blueprint
- Configure graphical installer ISO and test VM outputs

modules/system/audio.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+
+{
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+}

modules/system/bluetooth.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+  services.blueman.enable = true;
+}

modules/system/default.nix

@@ -1,9 +1,13 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   imports = [
     ./plymouth.nix
     ./sddm.nix
     ./hardware.nix
+    ./audio.nix
+    ./bluetooth.nix
+    ./network.nix
+    ./impermanence.nix
   ];
 }

modules/system/impermanence.nix

@@ -0,0 +1,58 @@
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  cfg = config.nomarchy.system.impermanence;
+in
+{
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
+  options.nomarchy.system.impermanence = {
+    enable = lib.mkEnableOption "Erase Your Darlings (Impermanence) root wipe on boot";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # 1. The Rollback Script: Runs in initrd before filesystems are mounted
+    boot.initrd.postDeviceCommands = lib.mkAfter ''
+      mkdir -p /btrfs_tmp
+      mount -o subvol=/ /dev/mapper/crypted /btrfs_tmp
+      
+      if [[ -e /btrfs_tmp/@ ]]; then
+          mkdir -p /btrfs_tmp/old_roots
+          timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/@)" "+%Y-%m-%-d_%H:%M:%S")
+          mv /btrfs_tmp/@ "/btrfs_tmp/old_roots/$timestamp"
+      fi
+
+      delete_subvolume_recursively() {
+          IFS=$'\n'
+          for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+              delete_subvolume_recursively "/btrfs_tmp/$i"
+          done
+          btrfs subvolume delete "$1"
+      }
+
+      for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+          delete_subvolume_recursively "$i"
+      done
+
+      btrfs subvolume snapshot /btrfs_tmp/root-blank /btrfs_tmp/@
+      umount /btrfs_tmp
+    '';
+
+    # 2. Persistence Configuration: What survives the wipe
+    environment.persistence."/persist" = {
+      hideMounts = true;
+      directories = [
+        "/var/log"
+        "/var/lib/nixos"
+        "/var/lib/systemd/coredump"
+        "/var/lib/bluetooth"
+        "/etc/NetworkManager/system-connections"
+      ];
+      files = [
+        "/etc/machine-id"
+      ];
+    };
+  };
+}

modules/system/network.nix

@@ -0,0 +1,5 @@
+{ config, pkgs, ... }:
+
+{
+  networking.networkmanager.enable = true;
+}

modules/system/supergfxd.nix

@@ -0,0 +1,6 @@
+{ config, pkgs, ... }:
+
+{
+  services.supergfxd.enable = true;
+  # NixOS handles the configuration of supergfxd
+}