feat(services): add podman, flatpak (+ Flathub) and pika backup

Extend nomarchy.services.* with three more opt-in toggles:
- podman: rootless containers, `docker` aliased to it, container DNS, and a
  subuid/subgid range for the login user.
- flatpak: services.flatpak + a oneshot that adds the Flathub remote
  system-wide (idempotent, retries when online).
- pika: ships pika-backup, the GUI for scheduled Borg backups.
Commented examples in the downstream system.nix template, per convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/system.nix

@@ -33,6 +33,9 @@
   #
   # nomarchy.services.tailscale.enable = true; # mesh VPN — then `sudo tailscale up`
   # nomarchy.services.syncthing.enable = true; # file sync — GUI at http://127.0.0.1:8384
+  # nomarchy.services.podman.enable = true;    # rootless containers (docker → podman)
+  # nomarchy.services.flatpak.enable = true;   # Flatpak + the Flathub remote
+  # nomarchy.services.pika.enable = true;      # Pika Backup (GUI Borg backups)
 
   system.stateVersion = "26.05";
 }