feat(services): full optional app menu + 7 more opt-in service toggles

Make the whole workstation menu available, all off/commented by default.

home.nix: the bare GUI apps become a categorized commented menu (~50
suggestions across browsers, comms, office, notes, code, graphics, A/V,
media, gaming, files/sync, security, system, local AI) — uncomment to add.

services.nix: the members that need system config (not just a package)
become opt-in nomarchy.services.* toggles, each with a commented example
in the downstream system.nix:
  - docker     → rootful Docker + user in docker group; asserts against the
                 podman docker-compat (both provide the `docker` command)
  - kdeconnect → programs.kdeconnect (opens phone-pairing ports)
  - gamemode   → Feral GameMode daemon
  - adb        → android-tools (programs.adb was removed; systemd ≥258 does
                 the device uaccess udev rules, so no group needed)
  - wireshark  → Qt GUI + user in wireshark group (capture without root)
  - ollama     → local LLM runtime on 127.0.0.1:11434
  - printing   → CUPS + Avahi/mDNS network printer discovery

README option table and ROADMAP (services item now "Fifteen shipped";
local-AI / containers / gaming / devices areas marked) updated. All seven
branches eval-verified with the toggles forced on; the docker/podman
assertion confirmed firing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/home.nix

@@ -41,10 +41,11 @@
   # keybinds, theming — comes from the modules; these are the heavier
   # standalone apps the distro doesn't impose by default.
   #
-  # Gaming (Steam) and VMs (virt-manager) are NOT here — they need system
-  # setup beyond a package (32-bit libs, a daemon, group membership), so
-  # they're opt-in service toggles in system.nix instead
-  # (nomarchy.services.steam / nomarchy.services.libvirt).
+  # Apps that need system setup beyond a package (Steam's 32-bit stack,
+  # a daemon, group membership, a kernel module) are NOT here — they're
+  # opt-in service toggles in system.nix instead (nomarchy.services.* —
+  # steam, libvirt, obs, docker, gamemode, kdeconnect, adb, wireshark,
+  # ollama, printing).
   home.packages = with pkgs; [
     libreoffice-fresh   # office suite (documents, sheets, slides)
     vscode              # code editor (unfree; allowUnfree is on)
@@ -53,17 +54,86 @@
     mpv                 # media player
     amberol             # music player (local library; streaming → spotify below)
 
-    # ── Uncomment to add ──
-    # firefox               # a web browser (pick your own)
-    # thunderbird           # email client
-    # signal-desktop        # Signal messenger
-    # telegram-desktop      # Telegram
-    # zoom-us               # Zoom video calls (unfree)
-    # teams-for-linux       # Microsoft Teams (community client — no official Linux app)
-    # logseq                # notes / outliner (PKM)
-    # lmstudio              # local LLM runner (unfree; large closure)
-    # kdePackages.kdenlive  # non-linear video editor (pulls in KDE libs)
-    # spotify               # music streaming (unfree)
-    # texliveFull           # full LaTeX toolchain — multi-GB (texliveMedium is lighter)
+    # ── More apps — uncomment to add ─────────────────────────────────
+    # Web browsers
+    # firefox
+    # chromium
+    # ungoogled-chromium
+    # brave                       # (unfree)
+    # google-chrome               # (unfree)
+
+    # Communication
+    # signal-desktop
+    # telegram-desktop
+    # element-desktop             # Matrix
+    # vesktop                     # Discord (themeable client)
+    # slack                       # (unfree)
+    # zoom-us                     # (unfree)
+    # teams-for-linux             # community client (no official Linux app)
+    # thunderbird                 # email
+
+    # Office & documents
+    # onlyoffice-desktopeditors   # stronger MS-Office fidelity
+    # kdePackages.okular          # PDF viewer
+    # xournalpp                   # PDF annotation
+    # pdfarranger
+    # calibre                     # ebook library
+    # texliveFull                 # full LaTeX toolchain — multi-GB (texliveMedium is lighter)
+
+    # Notes / research
+    # logseq
+    # obsidian                    # (unfree)
+    # joplin-desktop
+    # anki-bin                    # flashcards
+    # zotero                      # reference manager
+
+    # Code & data
+    # zed-editor
+    # lazygit
+    # dbeaver-bin                 # database GUI
+    # bruno                       # API client
+    # distrobox                   # containerized dev shells
+
+    # Graphics & design
+    # krita                       # digital painting
+    # blender                     # 3D
+    # darktable                   # RAW photo
+
+    # Audio / video
+    # audacity
+    # shotcut                     # video editor
+    # kdePackages.kdenlive        # video editor (pulls in KDE libs)
+    # handbrake                   # transcoder
+
+    # Media
+    # vlc
+    # spotify                     # (unfree)
+    # newsflash                   # RSS reader
+
+    # Gaming (Steam + GameMode are service toggles in system.nix)
+    # lutris
+    # heroic                      # Epic/GOG launcher
+    # bottles                     # Wine prefixes
+    # prismlauncher               # Minecraft
+    # protonup-qt                 # Proton-GE manager
+    # mangohud                    # in-game overlay
+
+    # Files, sync & torrents
+    # nextcloud-client
+    # localsend                   # AirDrop-like transfer
+    # qbittorrent
+
+    # Security
+    # keepassxc
+    # bitwarden-desktop
+
+    # System
+    # gnome-disk-utility
+    # gparted
+    # baobab                      # disk usage
+
+    # Local AI (Ollama is a service toggle in system.nix)
+    # lmstudio                    # (unfree; large closure)
+    # alpaca                      # GTK Ollama UI
   ];
 }