feat(services): add podman, flatpak (+ Flathub) and pika backup

Extend nomarchy.services.* with three more opt-in toggles:
- podman: rootless containers, `docker` aliased to it, container DNS, and a
  subuid/subgid range for the login user.
- flatpak: services.flatpak + a oneshot that adds the Flathub remote
  system-wide (idempotent, retries when online).
- pika: ships pika-backup, the GUI for scheduled Borg backups.
Commented examples in the downstream system.nix template, per convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/nixos/services.nix

@@ -1,10 +1,9 @@
 # Opt-in services & integrations — off by default, one toggle each, enabled
 # in system.nix (see the commented examples in the downstream template).
-# These are system services: Tailscale is system-only, and Syncthing runs as
-# the login user. Their own `nomarchy.services.*` namespace, distinct from the
-# distro's core `nomarchy.system.*` toggles. `username` (from specialArgs) is
-# read lazily, only when Syncthing is enabled.
-{ config, lib, ... }@args:
+# These are system-side: their own `nomarchy.services.*` namespace, distinct
+# from the distro's core `nomarchy.system.*` toggles. `username` (from
+# specialArgs) is read lazily, only where a service needs it.
+{ config, lib, pkgs, ... }@args:
 
 let
   cfg = config.nomarchy.services;
@@ -18,6 +17,18 @@ in
     syncthing.enable = lib.mkEnableOption ''
       Syncthing continuous file sync, running as the login user — add
       folders and devices in the web UI at http://127.0.0.1:8384'';
+
+    podman.enable = lib.mkEnableOption ''
+      Podman for rootless containers, with `docker` aliased to it and DNS on
+      the default network; the login user gets a subuid/subgid range'';
+
+    flatpak.enable = lib.mkEnableOption ''
+      Flatpak, with the Flathub remote added system-wide — install apps with
+      `flatpak install flathub <app>`'';
+
+    pika.enable = lib.mkEnableOption ''
+      Pika Backup, a friendly GUI for scheduled Borg backups (the app;
+      configure repositories and schedules inside it)'';
   };
 
   config = lib.mkMerge [
@@ -36,5 +47,38 @@ in
         guiAddress = "127.0.0.1:8384";
       };
     })
+
+    (lib.mkIf cfg.podman.enable {
+      virtualisation.podman = {
+        enable = true;
+        dockerCompat = lib.mkDefault true; # `docker` → podman (off if you run real docker)
+        defaultNetwork.settings.dns_enabled = true; # DNS for rootless containers
+      };
+      # Rootless podman needs a subuid/subgid range for the user.
+      users.users.${args.username}.autoSubUidGidRange = lib.mkDefault true;
+    })
+
+    (lib.mkIf cfg.flatpak.enable {
+      services.flatpak.enable = true;
+      # Flatpak ships no remotes; add Flathub system-wide. Idempotent
+      # (--if-not-exists), and it reads the .flatpakrepo over the network, so
+      # it waits for connectivity and simply retries next boot if offline.
+      systemd.services.nomarchy-flathub = {
+        description = "Add the Flathub Flatpak remote";
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+        path = [ pkgs.flatpak ];
+        serviceConfig.Type = "oneshot";
+        script = ''
+          flatpak remote-add --system --if-not-exists flathub \
+            https://dl.flathub.org/repo/flathub.flatpakrepo
+        '';
+      };
+    })
+
+    (lib.mkIf cfg.pika.enable {
+      environment.systemPackages = [ pkgs.pika-backup ];
+    })
   ];
 }