feat(session): first-boot welcome toast (#81)

One-shot user unit fires a dismissible "You're set" notification on the
first graphical session (SUPER+M / SUPER+T / SUPER+? + Network + Doctor),
then writes settings.firstBootShown into the flake checkout. Skips the
live ISO hostname (hosts/live.nix keeps its own toast). Toggle:
nomarchy.firstBootWelcome.enable. checks.first-boot covers the gate.

Verified: V2 — flake check --no-build; checks.first-boot green; local
shim smoke; downstream-template-home ships the unit.

modules/home/theme.nix

@@ -70,6 +70,8 @@ let
     # name in hyprland.nix — the monitor twin of the keyboard graduation.
     # settings.displayProfile / displayProfileAuto: active named layout +
     # auto-switch on plug events (hyprland.nix / Display menu).
+    # settings.firstBootShown: first-session welcome toast gate (#81) —
+    # written true after the toast fires (nomarchy-first-boot).
     # Defaulted so a sparse/older state file still evaluates; nomarchy.settings
     # exposes them.
     settings = {
@@ -82,6 +84,7 @@ let
       autoTimezone = false;
       displayProfile = "";
       displayProfileAuto = false;
+      firstBootShown = false;
     };
   };