feat(power): suspend-then-hibernate 1h on battery (#115)

Human decision: 1h delay, battery only, Preferences enable/disable.
Wire systemd suspend-then-hibernate + HibernateDelaySec=1h +
HibernateOnACPower=false when settings.power.suspendThenHibernate is on
and boot.resumeDevice is set. Lid: s2h undocked, plain suspend on AC.
nomarchy-suspend for hypridle + Power menu (live state). LUKS unlock
before encrypted hibernate so s2h→disk is not double-password.
state-bridges assert the policy; HARDWARE-QUEUE #115 + suggested order.

V1: nix flake check --no-build. V3: bag-carry on hardware.

templates/downstream/system.nix

@@ -47,6 +47,8 @@
   #   backend = "ppd";                         #   "ppd" (default) or "tlp"
   #   laptop = true;                           #   required by batteryChargeLimit
   #   batteryChargeLimit = 80;                 #   cap charging for longevity
+  #   # suspendThenHibernate = true;           #   1h on battery → hibernate (#115);
+  #                                            #   menu: Preferences › Suspend then hibernate
   #   thermal.enable = true;                   #   thermald (Intel CPUs)
   # };
   #