docs(webcam): portal/Flatpak IR gap is v4l2-only (#71)

Ship the recommended document-only path: WirePlumber hideIrSensor acts
on the v4l2 monitor only; libcamera / xdg-desktop-portal / Flatpak
camera pickers can still list the internal IR sensor.

- HARDWARE.md §7: dual-sensor subsection (scope, workaround, deferred)
- ROADMAP § Webcam: ✓ #71; (b)/(c) stay hardware-gated
- README option row + HARDWARE-QUEUE T14s check for (b)/(c)
- Close BACKLOG #71; no libcamera rules

Verified: V0 (docs only).

docs/ROADMAP.md

@@ -539,10 +539,15 @@ Design/decision records and a running log of shipped work (items marked
     generated drop-in's serialized content is valid WP-0.5 config; and the exact
     shipped `irMatch` was re-confirmed live (1 V4L2 source = the colour
     `/dev/video0`, libcamera untouched, IR node disabled in the WirePlumber log).
-    Remaining: an on-Nomarchy end-to-end check; optional `v4l-utils` +
-    `cameractrls` for the rare genuine-tuning case; and a follow-up for
-    portal/Flatpak apps that consume the libcamera path (where the internal IR is
-    still listed, since libcamera stays on).
+    Remaining: an on-Nomarchy end-to-end check (HARDWARE-QUEUE › T14s);
+    optional `v4l-utils` + `cameractrls` already commented in the template.
+  - ✓ **Portal/Flatpak IR gap documented (#71, docs only):** the shipped
+    v4l2 IR-hide does **not** cover libcamera / xdg-desktop-portal /
+    Flatpak camera pickers (IR can still appear there). User-facing note
+    in [`HARDWARE.md` §7](HARDWARE.md). Engineering options (b) WirePlumber
+    libcamera GREY-only rule and (c) libcamera/udev-layer hide stay
+    deferred — both need a T14s-class dual-sensor machine to verify; no
+    libcamera rules in-tree.
 - ✓ **Memory-pressure protection (earlyoom, default-on):**
   `modules/nixos/oom.nix` — running out of memory kills the offending
   process instead of freezing the desktop. **earlyoom over systemd-oomd,