docs(roadmap): system VPN setup & management menu (WireGuard/OpenVPN/Tailscale)

A forward-looking item for a dedicated System → VPN flow: import
WireGuard .conf / OpenVPN .ovpn into NetworkManager and toggle them,
plus Tailscale up/down + exit-node (self-gated on nomarchy.services.
tailscale). Notes the plugin dep (networkmanager-openvpn), the Files
picker + Waybar-parity patterns, secrets staying in the connection
manager, and the import-first-vs-creation open question.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -97,6 +97,32 @@ how to override it. Items marked ✓ are shipped.
   UI (an unthemed browser page). Validated: the generated menu script's
   `bash -n` build check passes, and an eval confirms printing-on puts
   system-config-printer in `systemPackages`. Pending an on-machine check.
+- **VPN setup & management menu:** a dedicated **System → VPN** flow that goes
+  past today's Network module (`networkmanager_dmenu` only connects/disconnects
+  *existing* VPN connections) to a guided **setup + management** surface across
+  the three common kinds:
+  - **WireGuard:** import a `.conf` into NetworkManager (`nmcli connection import
+    type wireguard file …` — NM handles wg tunnels natively, no extra plugin)
+    and toggle it up/down.
+  - **OpenVPN:** import an `.ovpn` (`nmcli connection import type openvpn file …`),
+    which needs the `networkmanager-openvpn` plugin shipped — gate the import
+    entry on it (the wireguard path has no such dependency).
+  - **Tailscale:** `tailscale up/down`, status, and **exit-node** selection — it
+    lives outside NetworkManager, so the menu drives the `tailscale` CLI
+    directly, self-gated on `nomarchy.services.tailscale` (already an opt-in
+    service) like the other hardware-gated System entries.
+  Shape: a `nomarchy-menu vpn` rofi submenu under **System** (Connect/Disconnect
+  with each connection's live up/down state like the wifi picker · Import config
+  via the existing Files/`fd` picker pattern · the Tailscale block when present),
+  ending in `↩ Back`. A self-gating Waybar `custom/vpn` indicator (shield glyph
+  while a tunnel or Tailscale is up) for parity with the other status modules,
+  added to the summer whole-swaps too. Secrets stay in the connection manager's
+  own store (NetworkManager / Tailscale state) — no new secret manager (cf. the
+  deferred rofi-rbw/pass note above). Open question: how much in-menu *creation*
+  (vs import) to support — a from-scratch WireGuard keypair/peer editor is a lot
+  of rofi surface, so likely import-first, deferring creation to
+  `nm-connection-editor`. Complements the existing Network item rather than
+  replacing it.
 - **Theme parity with legacy:** summer-day/night now carry their legacy
   bar layouts as `waybar.jsonc` whole-swaps (adapted: dead legacy script
   modules dropped, Nerd-Fonts-v2 codepoints remapped to FontAwesome/v3,