feat(services): add podman, flatpak (+ Flathub) and pika backup

Extend nomarchy.services.* with three more opt-in toggles:
- podman: rootless containers, `docker` aliased to it, container DNS, and a
  subuid/subgid range for the login user.
- flatpak: services.flatpak + a oneshot that adds the Flathub remote
  system-wide (idempotent, retries when online).
- pika: ships pika-backup, the GUI for scheduled Borg backups.
Commented examples in the downstream system.nix template, per convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -261,21 +261,25 @@ how to override it. Items marked ✓ are shipped.
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a
   downstream flips on in one line. Keeps the base lean while making common
-  additions trivial. **✓ First two shipped** — `nomarchy.services.tailscale`
-  and `nomarchy.services.syncthing` (`modules/nixos/services.nix`, system-side;
-  Syncthing runs as the login user with its GUI on 127.0.0.1:8384), with
-  commented examples in the downstream `system.nix` template. More candidates
-  by area:
+  additions trivial. **✓ Five shipped** in `modules/nixos/services.nix`
+  (system-side), each with a commented example in the downstream `system.nix`
+  template: `tailscale`, `syncthing` (runs as the login user, GUI on
+  127.0.0.1:8384), `podman` (rootless, `docker` aliased, user subuid/subgid),
+  `flatpak` (+ Flathub remote added by a oneshot), `pika` (Pika Backup GUI).
+  More candidates by area:
   - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo)
   - **local AI:** LM Studio (`lmstudio`); Ollama (`services.ollama`, optional
     GPU accel) — pairs with the menu's Ask-Claude philosophy
-  - **containers/VMs:** Docker/Podman; libvirt + virt-manager
+  - ✓ **containers/VMs:** Podman (`virtualisation.podman`); Docker / libvirt +
+    virt-manager (todo)
   - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo)
   - **gaming/media:** Steam (`programs.steam`); OBS Studio
   - **devices:** printing (CUPS + Avahi); KDE Connect / phone integration;
     OpenRGB
-  - **backup:** restic/borg (`services.restic`)
-  - **escape hatch:** Flatpak (`services.flatpak`) for apps outside nixpkgs
+  - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); restic/borg
+    services (todo)
+  - ✓ **escape hatch:** Flatpak (`services.flatpak`) + Flathub, for apps
+    outside nixpkgs
 
   Surface decided: `nomarchy.services.*`, system-side for system services
   (home-side ones can extend the same prefix later). Remaining: curate the