docs: update README with feature overview and module structure

docs/README.md

@@ -17,16 +17,26 @@ How to work on it: [conventions.md](./conventions.md).
 
 Each machine: `modules/hosts/<name>/default.nix` → `nixosConfigurations.<name>`, real config in `*Configuration` + optional `_private/` and `_services/`.
 
+## Features at a glance
+
+- **Users catalog** — one catalog in `modules/system/users.nix`, pick who exists on a host with `chiasson.users.enabled = [ "example" ]`, override per host. Home Manager wires itself from the same list.
+- **SSH + Bitwarden (rbw) keys** — one ed25519 keypair per catalog user, private key in Bitwarden, public key in `modules/ssh/inventory.nix`. Outbound SSH uses a `.pub` filter against the rbw agent; inbound `authorized_keys` are generated from the same inventory. [Full wiring in conventions.md](./conventions.md#ssh-model).
+- **Wisdom modules** — Home Manager slices in `modules/wisdom/` auto-catalog via `lib.wisdomCatalogExtraModules` (defined in `modules/desktop/options.nix`). The baseline `wisdom` module handles git identity + shared tools; all other `wisdom*` exports are pulled in once per user through `desktopHomeBase` → `chiasson.users.extraModules.olivier`. Hosts only flip `chiasson.home.<category>.<slice>.enable` — no manual imports in `home.nix`. Categories include `apps` (spotify, discord, localsend), `browsers` (chrome, edge, zen, …), `editors` (cursor, vscode, obsidian, …), `shells` (bash, fish, oh-my-posh, yazi), `desktop` (gtk-qt-theming, screenshot), and `terminals` (kitty). Trivial single-package slices can be written with the `lib.wisdomSlice` helper instead of repeating the `root`/`cfg` + `mkIf` boilerplate.
+- **Wallpapers from a dedicated repo** — `modules/desktop/wallpapers.nix` pins `inputs.wallpapers` into the store and exposes it as `CHIASSON_NIX_WALLPAPERS` and `/etc/wallpapers`. Override `chiasson.desktop.wallpapers.source` if needed.
+- **Private host data** — import-tree skips `_private/` globally, so machine-only files (firmware quirks, display configs, service tweaks) live next to the host module without leaking elsewhere.
+
 ## Deploy / rebuild
 
-Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops).
+Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops/laptops/tablets).
 
 Fleet deploy is [Navi](https://github.com/cafkafk/navi) — config in `modules/deploy/navi.nix`, outputs `flake.navi` / `flake.naviHive`.
 
 ```bash
-nix develop          # devShell has navi + hints
+nix develop          # devShell has navi + just + hints
+just                  # list local helpers like `sync-dms`
 navi apply --on <host>
 navi apply-local --node 14900k --sudo   # this machine, if hostname matches
+navi tui                  # interactive fleet dashboard
 ```
 
 Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
@@ -37,11 +47,11 @@ Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
 modules/
   hosts/<host>/     # per-machine composition
   system/           # nixosModules.system aggregate
-  desktop/          # GUI stack
+  desktop/          # GUI stack (niri, hyprland, plasma, DMS)
   wisdom/           # HM modules (exports still named wisdom*)
   ssh/              # inbound NixOS + outbound HM
   deploy/           # navi hive
-  lib/              # pure helpers → flake.lib
+  patches/          # one-off patches (yt-dlp, t2fanrd, …)
 ```
 
 Machine-only stuff lives in `hosts/<host>/_private/` — import-tree skips `_private/` globally, so those files only get pulled in where you import them.