feat(services): opt-in Tailscale + Syncthing (nomarchy.services.*)

Start the opt-in services surface: nomarchy.services.{tailscale,syncthing},
off by default, in modules/nixos/services.nix. Tailscale ships the daemon
(authenticate with `sudo tailscale up`); Syncthing runs as the login user
with its GUI on 127.0.0.1:8384 (overrideDevices/Folders off so GUI-managed
folders survive rebuilds). username is read lazily, only when Syncthing is
on. Commented examples in the downstream system.nix template per the opt-in
convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/system.nix

@@ -30,6 +30,9 @@
   #   batteryChargeLimit = 80;                 #   cap charging for longevity
   #   thermal.enable = true;                   #   thermald (Intel CPUs)
   # };
+  #
+  # nomarchy.services.tailscale.enable = true; # mesh VPN — then `sudo tailscale up`
+  # nomarchy.services.syncthing.enable = true; # file sync — GUI at http://127.0.0.1:8384
 
   system.stateVersion = "26.05";
 }