feat(desktop): add screen brightness controls

Bind XF86MonBrightnessUp/Down to brightnessctl in the repeat-while-held
block, mirroring the volume keys. A new brightness module installs
brightnessctl's udev rule and adds the user to the video group so the
backlight can be dimmed without root.

modules/desktop/brightness.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Screen backlight control via brightnessctl.
+let
+  cfg = config.modules.desktop.brightness;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.brightness.enable = lib.mkEnableOption "brightnessctl backlight control";
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.brightnessctl ];
+
+    # The udev rule chgrps each backlight's brightness node to `video` and adds
+    # group write, so a member can dim the panel without root.
+    services.udev.packages = [ pkgs.brightnessctl ];
+    users.users.${user}.extraGroups = [ "video" ];
+  };
+}

modules/desktop/desktop.nix

@@ -25,5 +25,6 @@ in
     modules.desktop.theming.enable = lib.mkDefault true;
     modules.desktop.waybar.enable = lib.mkDefault true;
     modules.desktop.audio.enable = lib.mkDefault true;
+    modules.desktop.brightness.enable = lib.mkDefault true;
   };
 }

modules/desktop/hyprland/hyprland.nix

@@ -141,10 +141,14 @@ in
         ]
         ++ workspaceBinds;
 
-        # Volume keys repeat while held, capped at 150 percent.
+        # Volume and brightness keys repeat while held. Volume is capped at 150
+        # percent; brightnessctl floors the panel at its minimum so a full hold
+        # cannot black the screen out.
         binde = [
           ", XF86AudioRaiseVolume, exec, ${pkgs.wireplumber}/bin/wpctl set-volume -l 1.5 @DEFAULT_AUDIO_SINK@ 5%+"
           ", XF86AudioLowerVolume, exec, ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
+          ", XF86MonBrightnessUp, exec, ${pkgs.brightnessctl}/bin/brightnessctl set 5%+"
+          ", XF86MonBrightnessDown, exec, ${pkgs.brightnessctl}/bin/brightnessctl set 5%-"
         ];
 
         # Mute and media transport still fire while the session is locked.