feat(menu): VPN setup & management submenu (WireGuard/OpenVPN/Tailscale)

A dedicated System → VPN flow (nomarchy-vpn) past the wifi picker:
- NetworkManager VPN/WireGuard connections shown ● active / ○ inactive,
  toggled up/down on select (networkmanager-group users need no sudo).
- Import a *.conf / *.ovpn via the fd picker → nmcli connection import,
  type chosen by extension. networkmanager-openvpn ships system-side
  (networking.networkmanager.plugins, mkDefault) so the openvpn type is
  available; WireGuard is native to NetworkManager.
- Tailscale block, self-gated on the CLI (= nomarchy.services.tailscale):
  read-only status + up/down + exit-node; privileged actions go through a
  sudo terminal (the snapshot pattern), no operator wiring.

Waybar custom/vpn shield (nomarchy-vpn-status): self-hides unless a NM
tunnel or Tailscale is up; @good tone; click opens the submenu. Wired
into the generated bar and both summer whole-swaps. Decided import-first;
creation deferred to nm-connection-editor. ROADMAP marked shipped.

Eval + home/system builds green; both scripts pass bash -n. Pending an
on-machine check (live nmcli import/connect + Tailscale paths).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -97,32 +97,36 @@ how to override it. Items marked ✓ are shipped.
   UI (an unthemed browser page). Validated: the generated menu script's
   `bash -n` build check passes, and an eval confirms printing-on puts
   system-config-printer in `systemPackages`. Pending an on-machine check.
-- **VPN setup & management menu:** a dedicated **System → VPN** flow that goes
-  past today's Network module (`networkmanager_dmenu` only connects/disconnects
-  *existing* VPN connections) to a guided **setup + management** surface across
-  the three common kinds:
+- ✓ **VPN setup & management menu:** a dedicated **System → VPN** flow
+  (`nomarchy-vpn`, `modules/home/rofi.nix`) that goes past the Network module
+  (`networkmanager_dmenu` only connects/disconnects *existing* VPNs) to a guided
+  setup + management surface across the three common kinds:
   - **WireGuard:** import a `.conf` into NetworkManager (`nmcli connection import
-    type wireguard file …` — NM handles wg tunnels natively, no extra plugin)
-    and toggle it up/down.
-  - **OpenVPN:** import an `.ovpn` (`nmcli connection import type openvpn file …`),
-    which needs the `networkmanager-openvpn` plugin shipped — gate the import
-    entry on it (the wireguard path has no such dependency).
-  - **Tailscale:** `tailscale up/down`, status, and **exit-node** selection — it
-    lives outside NetworkManager, so the menu drives the `tailscale` CLI
-    directly, self-gated on `nomarchy.services.tailscale` (already an opt-in
-    service) like the other hardware-gated System entries.
-  Shape: a `nomarchy-menu vpn` rofi submenu under **System** (Connect/Disconnect
-  with each connection's live up/down state like the wifi picker · Import config
-  via the existing Files/`fd` picker pattern · the Tailscale block when present),
-  ending in `↩ Back`. A self-gating Waybar `custom/vpn` indicator (shield glyph
-  while a tunnel or Tailscale is up) for parity with the other status modules,
-  added to the summer whole-swaps too. Secrets stay in the connection manager's
-  own store (NetworkManager / Tailscale state) — no new secret manager (cf. the
-  deferred rofi-rbw/pass note above). Open question: how much in-menu *creation*
-  (vs import) to support — a from-scratch WireGuard keypair/peer editor is a lot
-  of rofi surface, so likely import-first, deferring creation to
-  `nm-connection-editor`. Complements the existing Network item rather than
-  replacing it.
+    type wireguard file …` — NM handles wg tunnels natively, no plugin) and
+    toggle it up/down.
+  - **OpenVPN:** import an `.ovpn` (`nmcli connection import type openvpn file …`);
+    the `networkmanager-openvpn` plugin ships system-side
+    (`networking.networkmanager.plugins`, mkDefault) so the openvpn type is
+    available — import type is chosen by file extension.
+  - **Tailscale:** status (read-only, no privilege) + `up`/`down` + **exit-node**
+    selection. It lives outside NetworkManager, so the menu drives the
+    `tailscale` CLI directly, **self-gated** on the CLI being present
+    (= `nomarchy.services.tailscale`). Privileged actions go through a terminal +
+    `sudo` (the snapshot-tool pattern) — no operator wiring.
+  Shape: a `nomarchy-menu vpn` rofi submenu under **System** — NM
+  VPN/WireGuard connections shown ● active / ○ inactive and toggled on select
+  (networkmanager-group users need no sudo), Import via the Files/`fd` picker
+  (`*.conf`/`*.ovpn`), the Tailscale block when present — ending in `↩ Back`. A
+  self-gating Waybar **`custom/vpn`** shield (`nomarchy-vpn-status`: shown only
+  while a NM tunnel or Tailscale is up; `@good` tone; click opens the submenu),
+  wired into the generated bar **and the summer whole-swaps**. Secrets stay in
+  the connection manager's own store (NetworkManager / Tailscale) — no new secret
+  manager (cf. the deferred rofi-rbw/pass note above). **Decided: import-first**
+  — a from-scratch WireGuard keypair/peer editor is too much rofi surface, so
+  creation is deferred to `nm-connection-editor`. Eval + build green; **pending
+  an on-machine check** (the nmcli import/up-down + Tailscale paths need a live
+  session with real configs). Remaining (optional): operator-set Tailscale so its
+  toggles skip the sudo terminal; richer exit-node display (country/city).
 - **Theme parity with legacy:** summer-day/night now carry their legacy
   bar layouts as `waybar.jsonc` whole-swaps (adapted: dead legacy script
   modules dropped, Nerd-Fonts-v2 codepoints remapped to FontAwesome/v3,