feat(services): full optional app menu + 7 more opt-in service toggles

Make the whole workstation menu available, all off/commented by default.

home.nix: the bare GUI apps become a categorized commented menu (~50
suggestions across browsers, comms, office, notes, code, graphics, A/V,
media, gaming, files/sync, security, system, local AI) — uncomment to add.

services.nix: the members that need system config (not just a package)
become opt-in nomarchy.services.* toggles, each with a commented example
in the downstream system.nix:
  - docker     → rootful Docker + user in docker group; asserts against the
                 podman docker-compat (both provide the `docker` command)
  - kdeconnect → programs.kdeconnect (opens phone-pairing ports)
  - gamemode   → Feral GameMode daemon
  - adb        → android-tools (programs.adb was removed; systemd ≥258 does
                 the device uaccess udev rules, so no group needed)
  - wireshark  → Qt GUI + user in wireshark group (capture without root)
  - ollama     → local LLM runtime on 127.0.0.1:11434
  - printing   → CUPS + Avahi/mDNS network printer discovery

README option table and ROADMAP (services item now "Fifteen shipped";
local-AI / containers / gaming / devices areas marked) updated. All seven
branches eval-verified with the toggles forced on; the docker/podman
assertion confirmed firing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/nixos/services.nix

@@ -45,6 +45,37 @@ in
       virtual camera — so an OBS scene can be selected as a webcam in Zoom,
       Teams or a browser (screen capture itself already works over the
       desktop's PipeWire portal)'';
+
+    docker.enable = lib.mkEnableOption ''
+      Docker (rootful) with the login user in the `docker` group. Mutually
+      exclusive with the podman toggle's docker-compat (both provide the
+      `docker` command) — enable only one'';
+
+    kdeconnect.enable = lib.mkEnableOption ''
+      KDE Connect for phone integration — shared clipboard, notifications and
+      file transfer with a paired phone; opens the firewall ports it needs'';
+
+    gamemode.enable = lib.mkEnableOption ''
+      Feral GameMode — a daemon games ask to apply a performance CPU governor
+      and IO/nice priorities while running (via `gamemoderun`)'';
+
+    adb.enable = lib.mkEnableOption ''
+      the Android platform tools (adb/fastboot) for flashing/debugging phones.
+      systemd ≥258 applies the device uaccess udev rules automatically, so the
+      tools alone are enough — no group dance'';
+
+    wireshark.enable = lib.mkEnableOption ''
+      Wireshark (the Qt GUI) for packet capture, with the login user in the
+      `wireshark` group so capture works without root'';
+
+    ollama.enable = lib.mkEnableOption ''
+      Ollama, a local LLM runtime serving an API on 127.0.0.1:11434 (pair it
+      with the lmstudio/alpaca GUIs). CPU by default — set
+      `services.ollama.acceleration` natively for GPU offload'';
+
+    printing.enable = lib.mkEnableOption ''
+      CUPS printing with Avahi/mDNS, so network printers are auto-discovered
+      (add vendor drivers via `services.printing.drivers`)'';
   };
 
   config = lib.mkMerge [
@@ -122,5 +153,56 @@ in
         options v4l2loopback devices=1 video_nr=10 card_label="OBS Virtual Camera" exclusive_caps=1
       '';
     })
+
+    (lib.mkIf cfg.docker.enable {
+      virtualisation.docker.enable = true;
+      users.users.${args.username}.extraGroups = [ "docker" ];
+      # Podman's docker-compat and real Docker both claim the `docker`
+      # command — guard against enabling both (unless you turn that off).
+      assertions = [{
+        assertion = !(cfg.podman.enable && config.virtualisation.podman.dockerCompat);
+        message = ''
+          nomarchy.services: docker and podman both provide the `docker`
+          command. Enable only one, or set
+          `virtualisation.podman.dockerCompat = false`.
+        '';
+      }];
+    })
+
+    (lib.mkIf cfg.kdeconnect.enable {
+      programs.kdeconnect.enable = true; # installs the app and opens its ports
+    })
+
+    (lib.mkIf cfg.gamemode.enable {
+      programs.gamemode.enable = true;
+    })
+
+    (lib.mkIf cfg.adb.enable {
+      # `programs.adb` was removed — systemd ≥258 handles the device uaccess
+      # udev rules, so the tools package is all that's needed now.
+      environment.systemPackages = [ pkgs.android-tools ];
+    })
+
+    (lib.mkIf cfg.wireshark.enable {
+      programs.wireshark = {
+        enable = true;
+        package = pkgs.wireshark; # the Qt GUI (the module defaults to the CLI)
+      };
+      users.users.${args.username}.extraGroups = [ "wireshark" ];
+    })
+
+    (lib.mkIf cfg.ollama.enable {
+      services.ollama.enable = true;
+    })
+
+    (lib.mkIf cfg.printing.enable {
+      services.printing.enable = true;
+      # mDNS so network printers show up without manual setup.
+      services.avahi = {
+        enable = true;
+        nssmdns4 = true;
+        openFirewall = true;
+      };
+    })
   ];
 }