refactor: major architectural restructure for theme-centric organization

Theme System:
- Move all theme app configs to apps/ subdirectory (20 themes)
- Add theme-loader.nix for dynamic theme config deployment
- Simplify stylix.nix to focus on base theming only

Override System:
- Add overrides.nix for file-based config overrides
- Add behavior-configs.nix for non-visual configuration
- Split hypr/nomarchy.conf into behavior vs visual sections

Module Improvements:
- Add lib.mkDefault to all customizable settings
- Add modules/lib/ with shared utilities and state schema
- Update all home and system modules for downstream overridability

Installer:
- New minimal TTY installer (installer/install.sh)
- Golden path: BTRFS + LUKS2 (disko-golden.nix)
- New installer-iso.nix for TTY-only installation
- Keep graphical installer as installerIsoGraphical option

Cleanup:
- Remove obsolete install.sh, disko-ext4.nix, install-nomarchy.sh
- Update live-iso.nix references
- Add .claude/ to .gitignore for local IDE settings

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

modules/system/audio.nix

@@ -1,12 +1,12 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
-  security.rtkit.enable = true;
+  security.rtkit.enable = lib.mkDefault true;
   services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    jack.enable = true;
+    enable = lib.mkDefault true;
+    alsa.enable = lib.mkDefault true;
+    alsa.support32Bit = lib.mkDefault true;
+    pulse.enable = lib.mkDefault true;
+    jack.enable = lib.mkDefault true;
   };
 }

modules/system/bluetooth.nix

@@ -1,7 +1,7 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
-  hardware.bluetooth.enable = true;
-  hardware.bluetooth.powerOnBoot = true;
-  services.blueman.enable = true;
+  hardware.bluetooth.enable = lib.mkDefault true;
+  hardware.bluetooth.powerOnBoot = lib.mkDefault true;
+  services.blueman.enable = lib.mkDefault true;
 }

modules/system/browser.nix

@@ -1,22 +1,30 @@
 { config, pkgs, lib, ... }:
 
 let
-  palettes = import ../../assets/themes/nomarchy-palettes.nix;
+  nomarchyLib = import ../lib { inherit lib; };
   activeThemeName = config.nomarchy.system.theme;
-  currentPalette = (palettes.${activeThemeName} or palettes.nord).palette;
-  
+  currentPalette = nomarchyLib.getPalette activeThemeName;
+
   # Hex color for browser theme (base00 is background)
   themeColor = "#${currentPalette.base00}";
-  
-  policy = {
+
+  # Detect light mode from theme name or palette
+  isLightTheme = nomarchyLib.isThemeLightMode {
+    themeName = activeThemeName;
+    assetsPath = ../../assets/themes;
+  };
+
+  browserPolicy = {
     BrowserThemeColor = themeColor;
-    BrowserColorScheme = if lib.strings.hasInfix "light" activeThemeName then "light" else "dark";
+    BrowserColorScheme = if isLightTheme then "light" else "dark";
   };
 in
 {
   # Chromium policies
-  programs.chromium.extraOpts = policy;
-  
-  # Brave policies (Brave on NixOS also respects some chromium policies if set via extraOpts)
-  # But better to use the specific brave module if available or just the same policy.
+  programs.chromium.extraOpts = lib.mkDefault browserPolicy;
+
+  # Brave browser policies via managed policy file
+  environment.etc."brave/policies/managed/nomarchy.json".text = lib.mkDefault (
+    builtins.toJSON browserPolicy
+  );
 }

modules/system/network.nix

@@ -4,22 +4,24 @@ let
   cfg = config.nomarchy.system;
 in
 {
-  networking.networkmanager.enable = true;
-  
-  networking.networkmanager.wifi.powersave = cfg.wifi.powersave;
+  networking.networkmanager.enable = lib.mkDefault true;
+
+  networking.networkmanager.wifi.powersave = lib.mkDefault cfg.wifi.powersave;
 
   # DNS Configuration
-  networking.nameservers = if cfg.dns == "Cloudflare" then [ "1.1.1.1" "1.0.0.1" ]
-                           else if cfg.dns == "Google" then [ "8.8.8.8" "8.8.4.4" ]
-                           else if cfg.dns == "Custom" then cfg.customDns
-                           else []; # DHCP lets NM handle it
+  networking.nameservers = lib.mkDefault (
+    if cfg.dns == "Cloudflare" then [ "1.1.1.1" "1.0.0.1" ]
+    else if cfg.dns == "Google" then [ "8.8.8.8" "8.8.4.4" ]
+    else if cfg.dns == "Custom" then cfg.customDns
+    else [] # DHCP lets NM handle it
+  );
 
   services.resolved = {
-    enable = cfg.dns != "DHCP";
-    dnssec = "allow-downgrade";
-    domains = [ "~." ];
-    fallbackDns = [ "9.9.9.9" "149.112.112.112" ];
-    extraConfig = ''
+    enable = lib.mkDefault (cfg.dns != "DHCP");
+    dnssec = lib.mkDefault "allow-downgrade";
+    domains = lib.mkDefault [ "~." ];
+    fallbackDns = lib.mkDefault [ "9.9.9.9" "149.112.112.112" ];
+    extraConfig = lib.mkDefault ''
       DNSOverTLS=opportunistic
     '';
   };

modules/system/plymouth.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   nomarchy-plymouth = pkgs.stdenv.mkDerivation {
@@ -16,15 +16,15 @@ let
   };
 in
 {
-  boot.initrd.systemd.enable = true;
-  boot.initrd.verbose = false;
-  console.earlySetup = true;
-  boot.consoleLogLevel = 0;
+  boot.initrd.systemd.enable = lib.mkDefault true;
+  boot.initrd.verbose = lib.mkDefault false;
+  console.earlySetup = lib.mkDefault true;
+  boot.consoleLogLevel = lib.mkDefault 0;
   boot.plymouth = {
-    enable = true;
-    themePackages = [ nomarchy-plymouth ];
-    theme = "nomarchy";
+    enable = lib.mkDefault true;
+    themePackages = lib.mkDefault [ nomarchy-plymouth ];
+    theme = lib.mkDefault "nomarchy";
   };
 
-  boot.kernelParams = [ "quiet" "splash" "loglevel=3" "rd.systemd.show_status=false" "rd.udev.log_level=3" "udev.log_priority=3" "boot.shell_on_fail" ];
+  boot.kernelParams = lib.mkDefault [ "quiet" "splash" "loglevel=3" "rd.systemd.show_status=false" "rd.udev.log_level=3" "udev.log_priority=3" "boot.shell_on_fail" ];
 }

modules/system/sddm.nix

@@ -18,11 +18,11 @@ let
   };
 in
 {
-  services.xserver.enable = true;
+  services.xserver.enable = lib.mkDefault true;
   services.displayManager.sddm = {
-    enable = true;
-    wayland.enable = true;
-    theme = "nomarchy";
+    enable = lib.mkDefault true;
+    wayland.enable = lib.mkDefault true;
+    theme = lib.mkDefault "nomarchy";
   };
 
   services.displayManager.defaultSession = lib.mkDefault "hyprland-uwsm";
@@ -32,12 +32,12 @@ in
     user = lib.mkDefault "nomarchy";
   };
 
-  environment.systemPackages = [ nomarchy-sddm-theme ];
+  environment.systemPackages = lib.mkDefault [ nomarchy-sddm-theme ];
 
   # Enable Hyprland system-level dependencies
   programs.hyprland = {
-    enable = true;
-    withUWSM = true;
+    enable = lib.mkDefault true;
+    withUWSM = lib.mkDefault true;
   };
-  programs.uwsm.enable = true;
+  programs.uwsm.enable = lib.mkDefault true;
 }

modules/system/state.nix

@@ -1,16 +1,8 @@
 { lib, ... }:
 
 let
-  stateFile = "/etc/nixos/state.json";
-  
-  # Helper to read state from a file, with a default
-  readState = file: default:
-    if builtins.pathExists file then
-      builtins.fromJSON (builtins.readFile file)
-    else
-      default;
-
-  systemState = readState stateFile {};
+  nomarchyLib = import ../lib { inherit lib; };
+  systemState = nomarchyLib.readSystemState;
 in
 {
   config.nomarchy.system = {

modules/system/systemd.nix

@@ -1,9 +1,9 @@
 { config, pkgs, lib, ... }:
 
 {
-  systemd.settings.Manager.DefaultTimeoutStopSec = "5s";
-  
-  systemd.services."user@".serviceConfig.TimeoutStopSec = "5s";
+  systemd.settings.Manager.DefaultTimeoutStopSec = lib.mkDefault "5s";
+
+  systemd.services."user@".serviceConfig.TimeoutStopSec = lib.mkDefault "5s";
 
   powerManagement.powerDownCommands = ''
     # --- force-igpu ---