Initial scaffold: idempotent Sunshine + Moonlight installer for Omarchy

Sets up bidirectional game streaming across Omarchy/Hyprland/Wayland
machines (NVIDIA desktop and AMD Framework laptop), with the Macbook
as an additional Moonlight client.

The same install.sh runs on either machine; GPU vendor is detected at
runtime and the appropriate hardware-encode packages are installed.

Includes:
- KMS capture setup (cap_sys_admin on sunshine, input group, uinput udev rule)
- ufw / firewalld port opening when a firewall is active
- systemd --user service + loginctl enable-linger for always-on hosting
- uninstall.sh with --purge for user data removal
- Flags to install host-only or client-only

lib/service.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Enable Sunshine as a systemd --user service and turn on lingering so it
+# runs at boot without a graphical login.
+
+enable_sunshine_service() {
+  if ! systemctl --user list-unit-files sunshine.service >/dev/null 2>&1; then
+    err "sunshine.service not found in user systemd units. Did the package install correctly?"
+    return 1
+  fi
+
+  if ! loginctl show-user "$USER" -p Linger --value 2>/dev/null | grep -qx yes; then
+    info "Enabling user lingering (loginctl enable-linger $USER)"
+    as_root loginctl enable-linger "$USER"
+  else
+    ok "User lingering already enabled"
+  fi
+
+  info "Enabling sunshine.service (user)"
+  systemctl --user enable sunshine.service >/dev/null
+
+  info "Starting sunshine.service (user)"
+  # Restart so a re-run picks up new config / new caps. Tolerate first-launch races.
+  systemctl --user restart sunshine.service || systemctl --user start sunshine.service || {
+    err "Failed to start sunshine.service. Check: journalctl --user -u sunshine"
+    return 1
+  }
+
+  sleep 1
+  if systemctl --user is-active --quiet sunshine.service; then
+    ok "sunshine.service is active"
+  else
+    warn "sunshine.service did not stay active. Inspect: journalctl --user -u sunshine -n 50"
+  fi
+}