feat(services): openrgb + restic toggles; close out the opt-in services item

Finishing the four remaining "opt-in services" candidates — but two of
them aren't service-shaped, so the package-vs-toggle principle applies:

  - Nextcloud client  → a bare tray app; already in the app-suite menu,
                        not a service.
  - WireGuard         → NetworkManager (on distro-wide) imports .conf
                        tunnels natively, so there's no daemon to "just
                        enable". Only the wg/wg-quick CLI is missing →
                        wireguard-tools added to the app-suite menu.

The two that ARE config-backed become nomarchy.services.* toggles:

  - openrgb → services.hardware.openrgb (daemon + device udev rules).
  - restic  → a small scaffolded surface (repository / passwordFile /
              paths) over services.restic.backups: daily timer, 7/4/6
              retention, --exclude-caches, repo auto-init. Asserts that
              repository + passwordFile are set when enabled. passwordFile
              is typed `str`, not `path`, so a flake-relative secret can't
              be copied into the world-readable store.

README option table and ROADMAP (services now "Seventeen shipped";
cloud-sync / networking / backup / devices areas updated) + the downstream
system.nix examples. Both branches eval-verified; the restic assertions
confirmed firing when repo/password are unset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/home.nix

@@ -131,6 +131,7 @@
     # gnome-disk-utility
     # gparted
     # baobab                      # disk usage
+    # wireguard-tools             # WireGuard CLI (NetworkManager imports .conf tunnels natively)
 
     # Local AI (Ollama is a service toggle in system.nix)
     # lmstudio                    # (unfree; large closure)

templates/downstream/system.nix

@@ -46,6 +46,13 @@
   # nomarchy.services.wireshark.enable = true; # Wireshark GUI (wireshark group, no root)
   # nomarchy.services.ollama.enable = true;    # local LLM runtime (127.0.0.1:11434)
   # nomarchy.services.printing.enable = true;  # CUPS + Avahi network printer discovery
+  # nomarchy.services.openrgb.enable = true;   # RGB peripheral/motherboard lighting daemon
+  # nomarchy.services.restic = {               # scheduled (daily) restic backup
+  #   enable = true;
+  #   repository = "/mnt/backup/restic";       #   path or URL (sftp:/b2:/…)
+  #   passwordFile = "/etc/nomarchy/restic-password"; # absolute path, NOT in the flake
+  #   paths = [ "/home" ];
+  # };
 
   system.stateVersion = "26.05";
 }