Add runtime status checker + headless/X11 docs; distro-support refinements

- status.sh: runtime health check (service state, boot wiring, display backend auto-detect, encoder, ports, web UI, /dev/uinput, pairing) ending in a g2g verdict or concrete TODO list

- docs: TROUBLESHOOTING §12 (headless graphical-session.target boot trap) + §13 (X11/NVENC path & stale wlr drop-in env conflict); ARCHITECTURE capture-backend comparison; FOLLOWUPS P3 (installer X11/Ubuntu support); README diagnostics pointer

- lib/{config,packages,permissions,service}.sh, files/sway-headless.service: in-progress Debian/Ubuntu + headless support refinements

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/FOLLOWUPS.md

@@ -220,6 +220,38 @@ that prefix. Substantial work; not justified without a real second user.
 
 ---
 
+## P3 — Installer support for the X11/NVENC (non-Hyprland) headless path
+
+**Symptom**: `install.sh` only knows the Arch + Hyprland + wlr world. At least
+one real deployment is an **Ubuntu host running the X11/NVENC path** (headless
+Xorg on `:0`, `capture = x11`, NVIDIA TwinView virtual display) — set up
+entirely by hand. None of it is reproducible from the repo: not the
+`xorg-headless.service` unit, not the X11 `sunshine.conf`, not the
+`DISPLAY=:0` service drop-in, not the `default.target` boot wiring (see
+TROUBLESHOOTING.md §12–13).
+
+**Current workaround**: configure those hosts manually using the recipes now
+documented in ARCHITECTURE.md ("Headless capture backends") and
+TROUBLESHOOTING.md §13.
+
+**Fix sketch**:
+
+- A `--backend x11|wlr` flag (or auto-detect: Hyprland reachable → wlr,
+  NVIDIA + no Wayland compositor → x11).
+- `lib/config.sh`: emit the X11 conf variant when backend is x11.
+- Ship an `xorg-headless.service` + `xorg-headless.conf` template (the
+  `ConnectedMonitor`/`ModeValidation` block is GPU-output-specific — needs
+  `xrandr` detection or a prompt).
+- `lib/service.sh`: install the `default.target` boot drop-in for headless
+  hosts regardless of backend, and the `DISPLAY=:0` env drop-in for x11.
+- Debian/Ubuntu package install path (`apt` + the `.deb`), since `yay`/AUR
+  don't exist there. This is a larger lift than the flag itself.
+
+**Complexity**: medium-high. The capture-backend split is moderate; full
+Debian packaging support is the bulk of the work.
+
+---
+
 ## Not on the list (intentionally)
 
 - **TLS for the stream itself.** Sunshine and Moonlight handle this with