docs: hardware support guide + product backlog

Add docs/HARDWARE.md (layers, install path, firmware/fingerprint/NVIDIA
deep dives, unsupported machines, contributing a DMI line). Link from
README and MIGRATION; queue firmware UI, doctor checks, detect-hw CLI,
and related PROPOSED items in BACKLOG.

README.md

@@ -75,6 +75,7 @@ Flat on purpose. Two module trees, one options file each, no hidden layers.
 │   └── nomarchy-install/          # live-ISO installer (gum + disko + mkFlake)
 ├── templates/downstream/          # `nix flake init -t` starter for users
 ├── docs/TESTING.md                # how to verify changes (incl. AI-agent rules)
+├── docs/HARDWARE.md               # firmware, drivers, profiles, unsupported machines
 ├── docs/OVERRIDES.md              # how downstream users override defaults
 ├── docs/RECOVERY.md               # runbook: broken theme/desktop/boot → undo it
 ├── docs/ROADMAP.md                # design/decision records + shipped-fixes log
@@ -112,7 +113,8 @@ Like what you see? **`nomarchy-install`** (in a terminal) walks you through
 installing to disk: pick a disk, LUKS2 full-disk encryption **by default**
 (in exchange the desktop logs in passwordless — the passphrase already
 gates the machine), user + hostname + timezone, hardware autodetection
-(DMI → nixos-hardware profile), a hibernation-ready swapfile sized to RAM,
+(DMI → nixos-hardware profile — see **[docs/HARDWARE.md](docs/HARDWARE.md)**),
+a hibernation-ready swapfile sized to RAM,
 then disko partitions (GPT + ESP + BTRFS subvolumes incl. `@snapshots` —
 snapper timeline snapshots are on) and `nixos-install` runs — **without a
 network** when the ISO was built from a clean tree (the target's
@@ -287,7 +289,9 @@ machine after 10 seconds (`panic=10 oops=panic`) rather than hanging
 indefinitely. **`services.fwupd.enable`** is on by default for firmware
 updates via LVFS — it only refreshes metadata, never flashes on its own,
 so run `fwupdmgr update` to apply; disable with `services.fwupd.enable =
-false;` on machines without real firmware (VMs/headless). And
+false;` on machines without real firmware (VMs/headless). Full hardware
+story (profiles, fingerprint, NVIDIA, unsupported machines, contributing
+a DMI line): **[docs/HARDWARE.md](docs/HARDWARE.md)**. And
 **`services.earlyoom`** is on by default so running out of memory kills
 the offending process (with a desktop notification) instead of freezing
 the desktop — process-level on purpose, since a Hyprland session is one