gaming: add Steam/Sunshine stack + user-space toolkit

Host (hosts/common/features/gaming/):
- move steam.nix under gaming/, add gamemode + gamescope (capSysNice)
- sunshine.nix: Sunshine stream host for Moonlight/Nvidia Shield
  (openFirewall, capSysAdmin for Wayland/KMS capture, autoStart)

Home (home/common/programs/gaming.nix):
- reusable custom.gaming module: Lutris, Heroic, ProtonPlus,
  protontricks, MangoHud, vkbasalt, vulkan-tools
- NVIDIA-specific extras isolated behind custom.gaming.nvidia

Wire konishi: host imports ../gaming; home enables custom.gaming
with nvidia = true.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hosts/common/features/gaming/default.nix

@@ -0,0 +1,23 @@
+{ ... }:
+# Host-level gaming stack: the privileged pieces that home-manager can't
+# provide. GPU-vendor-agnostic — NVIDIA/Intel/AMD drivers come from the host's
+# gpu/* module. Pair this with the user-space toolkit in
+# home/common/programs/gaming.nix (custom.gaming).
+{
+  imports = [
+    ./steam.nix
+    ./sunshine.nix
+  ];
+
+  # Feral gamemode: games (and Lutris/Steam launch options) can request a
+  # CPU-governor / scheduling boost via `gamemoderun %command%`.
+  programs.gamemode.enable = true;
+
+  # Micro-compositor used for tear-free, frame-paced output and upscaling.
+  # capSysNice lets it use realtime scheduling (`--rt`), which also helps the
+  # Sunshine capture path stay smooth.
+  programs.gamescope = {
+    enable = true;
+    capSysNice = true;
+  };
+}

hosts/common/features/gaming/sunshine.nix

@@ -0,0 +1,24 @@
+{ ... }:
+# Sunshine — self-hosted game-stream host for Moonlight clients (the NVIDIA
+# Shield runs Moonlight). This is host-level because it needs root-owned bits:
+# a setcap wrapper for display capture, /dev/uinput for virtual gamepad/mouse,
+# and firewall ports.
+#
+# Encoding: on this host the RTX 4060's NVENC is picked up automatically from
+# the NVIDIA driver (hosts/common/features/gpu/nvidia.nix) — no config needed.
+# On an AMD/Intel host Sunshine would fall back to VAAPI; nothing here is
+# NVIDIA-specific, so this module is reusable as-is.
+#
+# First run: open https://<host>:47990 to set the web-UI credentials, then pair
+# the Shield (enter the PIN Moonlight shows). Moonlight discovers the host via
+# Sunshine's built-in mDNS, so no separate avahi service is required.
+{
+  services.sunshine = {
+    enable = true;
+    autoStart = true; # start with the graphical session
+    openFirewall = true; # 47984-48010 TCP + 47998-48010 UDP for Moonlight
+    # Required to capture the display under Wayland/KMS (Hyprland). Grants the
+    # setcap'd wrapper CAP_SYS_ADMIN.
+    capSysAdmin = true;
+  };
+}