feat(services): opt-in Tailscale + Syncthing (nomarchy.services.*)

Start the opt-in services surface: nomarchy.services.{tailscale,syncthing},
off by default, in modules/nixos/services.nix. Tailscale ships the daemon
(authenticate with `sudo tailscale up`); Syncthing runs as the login user
with its GUI on 127.0.0.1:8384 (overrideDevices/Folders off so GUI-managed
folders survive rebuilds). username is read lazily, only when Syncthing is
on. Commented examples in the downstream system.nix template per the opt-in
convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -261,22 +261,27 @@ how to override it. Items marked ✓ are shipped.
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a
   downstream flips on in one line. Keeps the base lean while making common
-  additions trivial. Candidates by area:
-  - **cloud/sync:** Nextcloud client; Syncthing (`services.syncthing`)
+  additions trivial. **✓ First two shipped** — `nomarchy.services.tailscale`
+  and `nomarchy.services.syncthing` (`modules/nixos/services.nix`, system-side;
+  Syncthing runs as the login user with its GUI on 127.0.0.1:8384), with
+  commented examples in the downstream `system.nix` template. More candidates
+  by area:
+  - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo)
   - **local AI:** LM Studio (`lmstudio`); Ollama (`services.ollama`, optional
     GPU accel) — pairs with the menu's Ask-Claude philosophy
   - **containers/VMs:** Docker/Podman; libvirt + virt-manager
-  - **networking:** Tailscale (`services.tailscale`); WireGuard
+  - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo)
   - **gaming/media:** Steam (`programs.steam`); OBS Studio
   - **devices:** printing (CUPS + Avahi); KDE Connect / phone integration;
     OpenRGB
   - **backup:** restic/borg (`services.restic`)
   - **escape hatch:** Flatpak (`services.flatpak`) for apps outside nixpkgs
 
-  Decisions: the curated set; whether system services and GUI apps share one
-  surface or split (`nomarchy.services.*` system-side vs home-side packages);
-  and how it relates to `nomarchy.apps.*` (opt-out suite). Unfree entries are
-  already covered (`allowUnfree = true`).
+  Surface decided: `nomarchy.services.*`, system-side for system services
+  (home-side ones can extend the same prefix later). Remaining: curate the
+  rest (Ollama, containers, Steam/OBS, printing, backups, Flatpak …) and
+  decide how it relates to `nomarchy.apps.*` (opt-out suite). Unfree entries
+  are already covered (`allowUnfree = true`).
 - ✓ **Display / monitor management:** declarative `nomarchy.monitors` (a
   per-output schema — name/resolution/position/scale/transform/mirror/
   bitdepth/vrr/disable) generates Hyprland `monitor` rules, keeping the