Add GPU-detected NVIDIA driver module

modules/user/nvidia.sh detects the card via lspci and installs the branch
that matches it: current (Turing+), 580xx (Volta/Pascal/Maxwell), 470xx
(Kepler), 390xx (Fermi); pre-Fermi is refused with an explanation.

- no prompt for a detected GPU (--nvidia=no is the opt-out, wired in setup.sh)
- Secure Boot gate: with enforcement on, the akmods key is generated and
  imported and the module stops BEFORE installing the driver, so nobody gets
  the documented unsigned-module black screen; off/setup-mode skips signing
  entirely (a MOK import is never processed when enforcement is off)
- bounded wait for the kmod build, so a reboot cannot land mid-build
- dnf mark user on the akmod; VA-API/vulkan offered as an opt-in extra
- never sets nvidia-drm.modeset=1 (RPM Fusion enables KMS; the flag conflicts
  with Fedora's simpledrm patch)
- branch chosen from the chip family in the PCI name, not the device-id
  ranges, which overlap between families

Tested with a stub harness (38 assertions, 14 scenarios): all four branch
mappings, multi-GPU warning, Optimus, pre-Fermi refusal, SB on/off/setup,
unparseable name fallback, idempotent re-run, build timeout.

README.md

@@ -34,6 +34,8 @@ lib/common.sh             colours, logging, dnf helpers, rpmfusion/terra, nerd f
 lib/session.sh            display-manager detection/switching, session entries
 modules/de/{gnome,plasma,xfce}.sh
 modules/twm/{niri,hyprland,mango,chadwm}.sh
+modules/user/dotfiles.sh   bare-repo dotfiles checkout
+modules/user/nvidia.sh     GPU-detected NVIDIA driver install
 ```
 
 Modules are **separate processes**, not sourced into `setup.sh`. That means a
@@ -75,6 +77,41 @@ Each module pulls in `lib/` by relative path, so it works both ways.
 `chadwm` is the only X11 entry in the menu. The other three are Wayland
 compositors — do not expect the same config story from it.
 
+## GPU drivers (NVIDIA)
+
+`modules/user/nvidia.sh` runs on **detected hardware**, no question asked: the
+card in the machine decides what is installed. Opt out with `--nvidia=no`
+(e.g. to stay on nouveau).
+
+Branch selection comes from the chip family in the name `lspci` prints, because
+the numeric device-id ranges overlap between families and a wrong guess installs
+a module the card cannot use:
+
+| Chip family in the name | Driver branch | Packages |
+|---|---|---|
+| `GB`/`AD`/`GA`/`TU` (Turing and newer) | current | `akmod-nvidia` + `xorg-x11-drv-nvidia-cuda` |
+| `GV`/`GP`/`GM` (Volta, Pascal, Maxwell) | 580xx | `akmod-nvidia-580xx` + `xorg-x11-drv-nvidia-580xx{,-cuda}` |
+| `GK` (Kepler) | 470xx | `akmod-nvidia-470xx` + `xorg-x11-drv-nvidia-470xx{,-cuda}` |
+| `GF` (Fermi) | 390xx | `akmod-nvidia-390xx` + `xorg-x11-drv-nvidia-390xx{,-cuda}` |
+| pre-Fermi (`G92`, `GT200`, ...) | none | refused: 340xx is EOL and needs a longterm kernel |
+
+If the name cannot be parsed, the module asks for the branch instead of guessing.
+
+**Secure Boot.** With enforcement on, the akmods key is generated and imported,
+and the module then *stops before installing the driver* — installing an
+unsigned module while Secure Boot enforces is the documented way to get a black
+screen, because the driver package blacklists nouveau as it lands. Enrol the key
+in MokManager at the next boot, then run the setup again. With Secure Boot off
+or in **Setup mode**, no signing happens at all: shim skips MokManager when
+enforcement is off, so an import request would just sit in the efivars.
+
+After the transaction the module waits (bounded, 5 min) for the akmod to build
+so you cannot reboot into a driverless boot, runs `dnf mark user` on the akmod
+(so `dnf autoremove` cannot take it), and offers VA-API decode + vulkan as an
+opt-in extra. Nothing here sets `nvidia-drm.modeset=1`: RPM Fusion's kernel
+package already enables KMS, and the flag now conflicts with Fedora's simpledrm
+early-boot patch.
+
 ## Display manager policy
 
 * A **DE module** leaves the DE's own greeter alone (GNOME→gdm, Plasma→sddm,