feat(desktop): add the Waybar status bar (task 0023)

Add a Waybar module to the desktop group, enabled through the aggregator,
showing workspaces with per-application icons plus a clock, MPRIS media
controls, audio, network, battery, and a do-not-disturb toggle.

The do-not-disturb widget drives mako's dnd mode and degrades gracefully
until the notifications module lands. Module glyphs are Nerd Font codepoints
decoded through JSON, backed by a system symbols font.

Add a PipeWire audio server so the bar's volume widget has a running sink to
read and drive.

modules/desktop/audio.nix

@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+# PipeWire as the desktop audio server.
+let
+  cfg = config.modules.desktop.audio;
+in
+{
+  options.modules.desktop.audio.enable = lib.mkEnableOption "the PipeWire audio server";
+
+  config = lib.mkIf cfg.enable {
+    # Realtime scheduling for the audio threads, so playback survives load.
+    security.rtkit.enable = true;
+
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      pulse.enable = true;
+    };
+  };
+}