feat(services): openrgb + restic toggles; close out the opt-in services item

Finishing the four remaining "opt-in services" candidates — but two of
them aren't service-shaped, so the package-vs-toggle principle applies:

  - Nextcloud client  → a bare tray app; already in the app-suite menu,
                        not a service.
  - WireGuard         → NetworkManager (on distro-wide) imports .conf
                        tunnels natively, so there's no daemon to "just
                        enable". Only the wg/wg-quick CLI is missing →
                        wireguard-tools added to the app-suite menu.

The two that ARE config-backed become nomarchy.services.* toggles:

  - openrgb → services.hardware.openrgb (daemon + device udev rules).
  - restic  → a small scaffolded surface (repository / passwordFile /
              paths) over services.restic.backups: daily timer, 7/4/6
              retention, --exclude-caches, repo auto-init. Asserts that
              repository + passwordFile are set when enabled. passwordFile
              is typed `str`, not `path`, so a flake-relative secret can't
              be copied into the world-readable store.

README option table and ROADMAP (services now "Seventeen shipped";
cloud-sync / networking / backup / devices areas updated) + the downstream
system.nix examples. Both branches eval-verified; the restic assertions
confirmed firing when repo/password are unset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -291,7 +291,7 @@ how to override it. Items marked ✓ are shipped.
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a
   downstream flips on in one line. Keeps the base lean while making common
-  additions trivial. **✓ Fifteen shipped** in `modules/nixos/services.nix`
+  additions trivial. **✓ Seventeen shipped** in `modules/nixos/services.nix`
   (system-side), each with a commented example in the downstream `system.nix`
   template: `tailscale`, `syncthing` (runs as the login user, GUI on
   127.0.0.1:8384), `podman` (rootless, `docker` aliased, user subuid/subgid),
@@ -302,24 +302,29 @@ how to override it. Items marked ✓ are shipped.
   usable as a webcam in Zoom/Teams), `docker` (rootful; asserts against the
   podman docker-compat), `kdeconnect`, `gamemode`, `adb` (android-tools;
   systemd handles the udev rules), `wireshark` (Qt GUI + the `wireshark`
-  group), `ollama` (local LLM
-  API on 127.0.0.1:11434), and `printing` (CUPS + Avahi mDNS). More
-  candidates by area:
-  - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo)
+  group), `ollama` (local LLM API on 127.0.0.1:11434), `printing` (CUPS +
+  Avahi mDNS), `openrgb` (RGB lighting daemon), and `restic` (scheduled
+  daily backup — a small option surface: `repository`/`passwordFile`/`paths`,
+  7/4/6 retention). More candidates by area:
+  - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client is a
+    bare tray app (in the app-suite menu, not a service)
   - ✓ **local AI:** Ollama (`nomarchy.services.ollama`, optional GPU accel)
     ships; LM Studio is a (commented) app-suite package (a bare GUI, no
     service) — pairs with the menu's Ask-Claude philosophy
   - ✓ **containers/VMs:** Podman (`virtualisation.podman`); libvirt +
     virt-manager (`nomarchy.services.libvirt`); Docker (`nomarchy.services.docker`)
-  - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo)
+  - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard needs no
+    toggle — NetworkManager (on by default) imports `.conf` tunnels natively;
+    the `wireguard-tools` CLI is in the app-suite menu
   - ✓ **gaming/media:** Steam (`nomarchy.services.steam`); OBS Studio
     (`nomarchy.services.obs`, with the v4l2loopback virtual camera); GameMode
     (`nomarchy.services.gamemode`)
   - ✓ **devices:** printing (CUPS + Avahi, `nomarchy.services.printing`); KDE
-    Connect (`nomarchy.services.kdeconnect`); OpenRGB (todo). Plus dev tooling
-    — Android `adb` and `wireshark` toggles
-  - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); restic/borg
-    services (todo)
+    Connect (`nomarchy.services.kdeconnect`); OpenRGB
+    (`nomarchy.services.openrgb`). Plus dev tooling — Android `adb` and
+    `wireshark` toggles
+  - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); scheduled
+    headless restic (`nomarchy.services.restic`)
   - ✓ **escape hatch:** Flatpak (`services.flatpak`) + Flathub, for apps
     outside nixpkgs