fix(menu): Back audit — cheatsheet gets ↩ Back, exceptions documented (item 24)

Audited every rofi -dmenu call site in the generated nomarchy-menu +
nomarchy-vpn. The earlier "Back everywhere" pass held up: power,
power-profile, theme, clipboard, files, audio, display (both stages),
capture, tools, system and all four VPN lists already end in ↩ Back.

Fixed: the keybinds cheatsheet — Enter on any row silently closed it;
it now ends in ↩ Back returning to the root picker (its launch point),
and Enter elsewhere stays a deliberate no-op.

Documented (rofi.nix, at the convention comment + call sites): external
modi (rofi-calc, rofi-emoji, networkmanager_dmenu, rofi-pulse-select)
cannot take an injected row — Esc is their back path; free-text
prompts (web, ask) have no list to append to.

Verified: V0; V1 (built nomarchy-menu, bash -n OK; awk audit over the
generated script shows the only back-less lists are the root picker —
by design — and the free-text prompt). V3 spot-check queued.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/home/rofi.nix

@@ -155,6 +155,10 @@ let
     # rofi has show-icons (on globally; passed explicitly on the icon menus).
     row() { printf '%s\0icon\x1f%s\n' "$1" "$2"; }
 
+    # Back-audit exceptions (item 24): external modi/tools (calc, emoji,
+    # networkmanager_dmenu, rofi-pulse-select) can't take an injected row —
+    # Esc is their back path; free-text prompts (web, ask) have no list to
+    # append to — Esc cancels. Everything hand-rolled gets the row below.
     # General menu convention: every list menu ends with a "↩ Back" entry that
     # returns one level up (so you never have to Esc out and reopen). `back`
     # emits it with an icon; plain pick-lists append the bare label instead.
@@ -249,6 +253,7 @@ ${themeRows}
         # Native rofi wifi/VPN picker (networkmanager_dmenu) over the system
         # NetworkManager — replaces the old nmtui-in-a-terminal flow. Reads
         # its config from xdg.configFile below (told to drive rofi).
+        # External tool: no injected ↩ Back row possible — Esc closes.
         exec networkmanager_dmenu ;;
 
       vpn)
@@ -357,7 +362,12 @@ ${themeRows}
 
       keybinds)
         # Read-only cheatsheet, generated from keybinds.nix at build time.
-        rofi -dmenu -i -p keys < ${cheatsheetFile} >/dev/null || exit 0 ;;
+        # Enter on a row is a deliberate no-op (nothing to launch); ↩ Back
+        # returns to the root picker, which is also where it's launched.
+        sel=$( { cat ${cheatsheetFile}; printf '%s\n' "$BACK"; } \
+          | rofi -dmenu -i -p keys ) || exit 0
+        [ "$sel" = "$BACK" ] && exec "$0"
+        exit 0 ;;
 
       ask)
         # Free-text question → claude CLI in a terminal (OAuth, no API key).