feat(menu): Recovery scopes (#111), System IA (#105), drop Control Center (#110)

System is Connectivity / Devices / Recovery / Preferences under the same
six-entry root. Recovery lists desktop (HM), system boot, and BTRFS files
once each with cost labels. Control Center is gone: blur/gaps live in Look
& Feel; update checks and Bluetooth/Printing package toggles in Preferences
(with rebuilds). docs/RECOVERY paths updated.

docs/RECOVERY.md

@@ -21,8 +21,10 @@ home-manager generations          # newest first, one per theme/HM change
 /nix/store/…-home-manager-generation/activate   # run the one you want
 ```
 
-The same picker lives in the menu: **System › Rollback** lists the
-recent desktop generations — pick one and it activates.
+The same picker lives in the menu: **System › Recovery › Desktop
+generation** lists the recent Home Manager generations — pick one and
+it activates. System-level undo is **System › Recovery › System boot
+generation** (boot menu) or **Files (BTRFS)** (snapper).
 
 Or simply apply a theme you know is good: `nomarchy-state-sync apply
 boreal` (or any preset). If a switch failed halfway, the state file is written
@@ -69,8 +71,8 @@ With `nomarchy.system.snapper.enable` (the installer's default on
 BTRFS), the root filesystem has hourly/daily history, and
 `nixos-rebuild-snap` leaves a snapshot right before a rebuild:
 
-- **GUI:** menu › System › Snapshots (btrfs-assistant; expects a polkit
-  password prompt).
+- **GUI:** menu › System › Recovery › Files (BTRFS) (btrfs-assistant;
+  expects a polkit password prompt).
 - **Terminal/SSH:** `sudo nomarchy-snapshots` — browse a snapshot's
   diff, **restore changed files** (snapper `undochange`), or **roll the
   whole root back** to a snapshot and reboot. Both destructive actions