feat(system): enable fwupd by default; document power options

Ship `services.fwupd.enable` distro-wide (mkDefault) for firmware updates
via LVFS — the daemon + metadata-refresh timer only, no automatic
flashing, so applying an update stays an explicit `fwupdmgr update`. A
no-op where LVFS sees no devices; overridable natively. Sits with the
other mkDefault desktop services rather than a nomarchy toggle (it's a
single service, like upower).

Also documents the `nomarchy.system.power.*` options in the README table
(missed when the power module landed) and adds a short note on the
fwupd default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -112,6 +112,15 @@ in
     services.gnome.gnome-keyring.enable = lib.mkDefault true;
     services.dbus.enable = lib.mkDefault true;
     services.upower.enable = lib.mkDefault true;
+
+    # Firmware updates via LVFS. Ships the daemon + its metadata-refresh
+    # timer only — it never flashes anything on its own; applying an update
+    # is an explicit `fwupdmgr update`. On by default as desktop security
+    # hygiene (BIOS/UEFI/Thunderbolt/SSD fixes land here); a clean no-op
+    # where LVFS sees no devices (VMs/headless). Disable natively with
+    # `services.fwupd.enable = false`.
+    services.fwupd.enable = lib.mkDefault true;
+
     networking.networkmanager.enable = lib.mkDefault true;
 
     # No double-unlock on hibernate. hypridle locks hyprlock before every