Add runtime status checker + headless/X11 docs; distro-support refinements

- status.sh: runtime health check (service state, boot wiring, display backend auto-detect, encoder, ports, web UI, /dev/uinput, pairing) ending in a g2g verdict or concrete TODO list

- docs: TROUBLESHOOTING §12 (headless graphical-session.target boot trap) + §13 (X11/NVENC path & stale wlr drop-in env conflict); ARCHITECTURE capture-backend comparison; FOLLOWUPS P3 (installer X11/Ubuntu support); README diagnostics pointer

- lib/{config,packages,permissions,service}.sh, files/sway-headless.service: in-progress Debian/Ubuntu + headless support refinements

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/permissions.sh

@@ -8,13 +8,33 @@ UINPUT_RULE_PATH="/etc/udev/rules.d/60-uinput.rules"
 UINPUT_RULE_CONTENT='KERNEL=="uinput", SUBSYSTEM=="misc", OPTIONS+="static_node=uinput", TAG+="uaccess", OWNER="root", GROUP="input", MODE="0660"'
 
 ensure_input_group() {
-  if id -nG "$USER" | tr ' ' '\n' | grep -qx input; then
-    ok "User '$USER' already in 'input' group"
+  _ensure_user_in_group input
+  # On Debian/Ubuntu, /dev/dri/renderD* nodes are mode 0660 owned by
+  # root:render, and /dev/dri/card* are root:video. Sway's wlroots renderer
+  # needs the render node (Vulkan/GLES FD); KMS capture needs the card node.
+  # Arch typically grants both via udev tag=uaccess for the logged-in seat,
+  # so we only add explicit memberships on Debian.
+  if [[ "${DISTRO:-}" == "debian" ]]; then
+    _ensure_user_in_group render
+    _ensure_user_in_group video
+  fi
+}
+
+# Internal: add $USER to a group if it exists and they're not already in it.
+_ensure_user_in_group() {
+  local g="$1"
+  if ! getent group "$g" >/dev/null 2>&1; then
+    info "Group '$g' does not exist on this system — skipping."
     return 0
   fi
-  info "Adding '$USER' to 'input' group"
-  as_root usermod -aG input "$USER"
-  warn "You must log out and back in (or run 'newgrp input') for this to take effect."
+  if id -nG "$USER" | tr ' ' '\n' | grep -qx "$g"; then
+    ok "User '$USER' already in '$g' group"
+    return 0
+  fi
+  info "Adding '$USER' to '$g' group"
+  as_root usermod -aG "$g" "$USER"
+  warn "Group '$g' change takes effect on next login (or 'newgrp $g'). For systemd-user"
+  warn "services, you must fully log out and back in so the user manager restarts."
 }
 
 ensure_uinput_udev_rule() {