feat(services): full optional app menu + 7 more opt-in service toggles

Make the whole workstation menu available, all off/commented by default.

home.nix: the bare GUI apps become a categorized commented menu (~50
suggestions across browsers, comms, office, notes, code, graphics, A/V,
media, gaming, files/sync, security, system, local AI) — uncomment to add.

services.nix: the members that need system config (not just a package)
become opt-in nomarchy.services.* toggles, each with a commented example
in the downstream system.nix:
  - docker     → rootful Docker + user in docker group; asserts against the
                 podman docker-compat (both provide the `docker` command)
  - kdeconnect → programs.kdeconnect (opens phone-pairing ports)
  - gamemode   → Feral GameMode daemon
  - adb        → android-tools (programs.adb was removed; systemd ≥258 does
                 the device uaccess udev rules, so no group needed)
  - wireshark  → Qt GUI + user in wireshark group (capture without root)
  - ollama     → local LLM runtime on 127.0.0.1:11434
  - printing   → CUPS + Avahi/mDNS network printer discovery

README option table and ROADMAP (services item now "Fifteen shipped";
local-AI / containers / gaming / devices areas marked) updated. All seven
branches eval-verified with the toggles forced on; the docker/podman
assertion confirmed firing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -291,7 +291,7 @@ how to override it. Items marked ✓ are shipped.
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a
   downstream flips on in one line. Keeps the base lean while making common
-  additions trivial. **✓ Eight shipped** in `modules/nixos/services.nix`
+  additions trivial. **✓ Fifteen shipped** in `modules/nixos/services.nix`
   (system-side), each with a commented example in the downstream `system.nix`
   template: `tailscale`, `syncthing` (runs as the login user, GUI on
   127.0.0.1:8384), `podman` (rootless, `docker` aliased, user subuid/subgid),
@@ -299,18 +299,25 @@ how to override it. Items marked ✓ are shipped.
   `steam` (`programs.steam` — the 32-bit stack, controller udev, Remote-Play
   ports a bare package can't), `libvirt` (libvirtd + virt-manager, user added
   to the `libvirtd` group), `obs` (OBS Studio + a v4l2loopback virtual camera
-  usable as a webcam in Zoom/Teams). More candidates by area:
+  usable as a webcam in Zoom/Teams), `docker` (rootful; asserts against the
+  podman docker-compat), `kdeconnect`, `gamemode`, `adb` (android-tools;
+  systemd handles the udev rules), `wireshark` (Qt GUI + the `wireshark`
+  group), `ollama` (local LLM
+  API on 127.0.0.1:11434), and `printing` (CUPS + Avahi mDNS). More
+  candidates by area:
   - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo)
-  - **local AI:** LM Studio ships as a (commented) app-suite package — a bare
-    GUI, no service config; Ollama (`services.ollama`, optional GPU accel) is
-    the service still todo — pairs with the menu's Ask-Claude philosophy
+  - ✓ **local AI:** Ollama (`nomarchy.services.ollama`, optional GPU accel)
+    ships; LM Studio is a (commented) app-suite package (a bare GUI, no
+    service) — pairs with the menu's Ask-Claude philosophy
   - ✓ **containers/VMs:** Podman (`virtualisation.podman`); libvirt +
-    virt-manager (`nomarchy.services.libvirt`); Docker (todo)
+    virt-manager (`nomarchy.services.libvirt`); Docker (`nomarchy.services.docker`)
   - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo)
   - ✓ **gaming/media:** Steam (`nomarchy.services.steam`); OBS Studio
-    (`nomarchy.services.obs`, with the v4l2loopback virtual camera)
-  - **devices:** printing (CUPS + Avahi); KDE Connect / phone integration;
-    OpenRGB
+    (`nomarchy.services.obs`, with the v4l2loopback virtual camera); GameMode
+    (`nomarchy.services.gamemode`)
+  - ✓ **devices:** printing (CUPS + Avahi, `nomarchy.services.printing`); KDE
+    Connect (`nomarchy.services.kdeconnect`); OpenRGB (todo). Plus dev tooling
+    — Android `adb` and `wireshark` toggles
   - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); restic/borg
     services (todo)
   - ✓ **escape hatch:** Flatpak (`services.flatpak`) + Flathub, for apps