Initial scaffold: idempotent Sunshine + Moonlight installer for Omarchy

Sets up bidirectional game streaming across Omarchy/Hyprland/Wayland
machines (NVIDIA desktop and AMD Framework laptop), with the Macbook
as an additional Moonlight client.

The same install.sh runs on either machine; GPU vendor is detected at
runtime and the appropriate hardware-encode packages are installed.

Includes:
- KMS capture setup (cap_sys_admin on sunshine, input group, uinput udev rule)
- ufw / firewalld port opening when a firewall is active
- systemd --user service + loginctl enable-linger for always-on hosting
- uninstall.sh with --purge for user data removal
- Flags to install host-only or client-only

install.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+# omarchy-moonlight installer
+# Sets up Sunshine (host) + Moonlight (client) on Omarchy/Hyprland/Wayland.
+# Idempotent: re-run safely. Same script works on NVIDIA and AMD machines.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "$SCRIPT_DIR/lib/common.sh"
+# shellcheck source=lib/detect.sh
+source "$SCRIPT_DIR/lib/detect.sh"
+# shellcheck source=lib/packages.sh
+source "$SCRIPT_DIR/lib/packages.sh"
+# shellcheck source=lib/permissions.sh
+source "$SCRIPT_DIR/lib/permissions.sh"
+# shellcheck source=lib/firewall.sh
+source "$SCRIPT_DIR/lib/firewall.sh"
+# shellcheck source=lib/service.sh
+source "$SCRIPT_DIR/lib/service.sh"
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [options]
+
+Installs Sunshine + Moonlight on an Omarchy machine.
+
+Options:
+  --no-autostart    Don't enable user service or lingering (manual start only)
+  --no-firewall     Skip firewall configuration
+  --no-moonlight    Don't install moonlight-qt (host-only setup)
+  --no-sunshine     Don't install sunshine (client-only setup)
+  -h, --help        Show this help
+
+Environment overrides:
+  SUNSHINE_PKG       AUR package to use for Sunshine (default: sunshine)
+                     Set to 'sunshine-bin' for the precompiled build.
+EOF
+}
+
+AUTOSTART=1
+FIREWALL=1
+INSTALL_SUNSHINE=1
+INSTALL_MOONLIGHT=1
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --no-autostart)  AUTOSTART=0 ;;
+    --no-firewall)   FIREWALL=0 ;;
+    --no-moonlight)  INSTALL_MOONLIGHT=0 ;;
+    --no-sunshine)   INSTALL_SUNSHINE=0 ;;
+    -h|--help)       usage; exit 0 ;;
+    *)               err "Unknown option: $1"; usage; exit 2 ;;
+  esac
+  shift
+done
+
+main() {
+  require_not_root
+  require_arch
+  require_yay
+
+  step "Detecting system"
+  detect_all
+  info "Host: $HOSTNAME_SHORT   GPU: $GPU_VENDOR   Session: $SESSION_TYPE"
+
+  if [[ $INSTALL_SUNSHINE -eq 1 ]]; then
+    step "Installing Sunshine and GPU encoder support"
+    install_sunshine
+    install_gpu_encoder_packages
+
+    step "Configuring permissions for KMS capture and virtual input"
+    ensure_input_group
+    ensure_uinput_udev_rule
+    set_sunshine_capabilities
+
+    if [[ $FIREWALL -eq 1 ]]; then
+      step "Configuring firewall for Sunshine ports"
+      open_sunshine_ports
+    else
+      info "Skipping firewall (--no-firewall)"
+    fi
+
+    if [[ $AUTOSTART -eq 1 ]]; then
+      step "Enabling Sunshine user service"
+      enable_sunshine_service
+    else
+      info "Skipping autostart (--no-autostart). Start manually with: systemctl --user start sunshine"
+    fi
+  else
+    info "Skipping Sunshine install (--no-sunshine)"
+  fi
+
+  if [[ $INSTALL_MOONLIGHT -eq 1 ]]; then
+    step "Installing Moonlight client"
+    install_moonlight
+  else
+    info "Skipping Moonlight install (--no-moonlight)"
+  fi
+
+  step "Done"
+  print_next_steps
+}
+
+print_next_steps() {
+  local ip
+  ip="$(ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 | head -n1)"
+  cat <<EOF
+
+  ${BOLD}Next steps:${RESET}
+
+  1. ${BOLD}Re-login${RESET} (or run ${DIM}newgrp input${RESET}) if you weren't already in the 'input' group.
+     This is required for Sunshine to access /dev/uinput.
+
+  2. Open Sunshine's web UI to set credentials and pair clients:
+       ${BOLD}https://localhost:47990${RESET}
+     (Self-signed cert — accept the browser warning.)
+
+  3. On a Moonlight client (this machine, the Framework, or your Mac):
+       - Add this host by IP: ${BOLD}${ip:-<your-lan-ip>}${RESET}
+       - Enter the 4-digit PIN that Sunshine's UI shows during pairing.
+
+  4. To check status:        ${DIM}systemctl --user status sunshine${RESET}
+     To view logs:           ${DIM}journalctl --user -u sunshine -f${RESET}
+     To uninstall:           ${DIM}$SCRIPT_DIR/uninstall.sh${RESET}
+
+EOF
+}
+
+main "$@"