Add GPU-detected NVIDIA driver module

modules/user/nvidia.sh detects the card via lspci and installs the branch
that matches it: current (Turing+), 580xx (Volta/Pascal/Maxwell), 470xx
(Kepler), 390xx (Fermi); pre-Fermi is refused with an explanation.

- no prompt for a detected GPU (--nvidia=no is the opt-out, wired in setup.sh)
- Secure Boot gate: with enforcement on, the akmods key is generated and
  imported and the module stops BEFORE installing the driver, so nobody gets
  the documented unsigned-module black screen; off/setup-mode skips signing
  entirely (a MOK import is never processed when enforcement is off)
- bounded wait for the kmod build, so a reboot cannot land mid-build
- dnf mark user on the akmod; VA-API/vulkan offered as an opt-in extra
- never sets nvidia-drm.modeset=1 (RPM Fusion enables KMS; the flag conflicts
  with Fedora's simpledrm patch)
- branch chosen from the chip family in the PCI name, not the device-id
  ranges, which overlap between families

Tested with a stub harness (38 assertions, 14 scenarios): all four branch
mappings, multi-GPU warning, Optimus, pre-Fermi refusal, SB on/off/setup,
unparseable name fallback, idempotent re-run, build timeout.

setup.sh

@@ -32,6 +32,7 @@ TWM=""
 SELINUX_OPT=""
 SNAPPER_OPT=""
 DOTFILES_OPT=""
+NVIDIA_OPT=""
 
 usage() {
     cat <<'EOF'
@@ -48,6 +49,8 @@ Options:
   --selinux=X   keep | disabled   (asked, default keep)
   --snapper=X   yes | no          (automatic on btrfs; use 'no' to opt out)
   --dotfiles=X  yes | no          (clone personal dotfiles, default no)
+  --nvidia=X    auto | no         (auto: install the matching NVIDIA driver
+                                   when an NVIDIA GPU is detected; default auto)
   -y, --yes     never prompt (requires --de and --twm)
   -d, --debug   pause after each section instead of aborting on error
   -h, --help    show this help
@@ -72,6 +75,7 @@ for arg in "$@"; do
         --selinux=*) SELINUX_OPT="${arg#*=}" ;;
         --snapper=*) SNAPPER_OPT="${arg#*=}" ;;
         --dotfiles=*) DOTFILES_OPT="${arg#*=}" ;;
+        --nvidia=*) NVIDIA_OPT="${arg#*=}" ;;
         --twm=*)    TWM="${arg#*=}" ;;
         -h|--help)  usage; exit 0 ;;
         *)
@@ -258,6 +262,15 @@ else
         *) err "Unknown --dotfiles value: '$DOTFILES_OPT' (yes|no)"; exit 2 ;;
     esac
 fi
+
+# GPU drivers are driven by DETECTED hardware, not by a prompt: an NVIDIA card
+# in the machine means install the branch that fits it. 'yes' is accepted as an
+# alias of 'auto' so muscle memory does not hit an error.
+case "${NVIDIA_OPT:-}" in
+    auto|yes|"") NVIDIA_OPT="auto" ;;
+    no)          NVIDIA_OPT="no" ;;
+    *) err "Unknown --nvidia value: '$NVIDIA_OPT' (auto|no)"; exit 2 ;;
+esac
 pause_if_debug
 
 #------------------------------------------
@@ -365,6 +378,14 @@ if [[ "$TWM" != "none" ]]; then
     pause_if_debug
 fi
 
+# Hardware drivers. The module re-detects the card and exits quietly when there
+# is none, so running it unconditionally is safe; --nvidia=no is the opt-out
+# (nouveau or a hand-built driver).
+if [[ "$NVIDIA_OPT" != "no" ]]; then
+    run_module "$SCRIPT_DIR/modules/user/nvidia.sh"
+    pause_if_debug
+fi
+
 #------------------------------------------
 # 6 Done
 #------------------------------------------
@@ -814,6 +835,15 @@ ok "TWM: $TWM"
 ok "SELinux: $([[ "$SELINUX_DISABLED" == "true" ]] && echo disabled || echo keeping)"
 ok "Btrfs snapshots: $([[ "$BTRFS_SNAPPER" == "true" ]] && echo yes || echo skipped)"
 ok "Dotfiles: $([[ "$DOTFILES" == "true" ]] && echo clone || echo no)"
+
+NV_VER=$(modinfo -F version nvidia 2>/dev/null) || true
+if [[ -n "${NV_VER:-}" ]]; then
+    ok "NVIDIA: module nvidia ${NV_VER} built (reboot if it was installed in this run)"
+elif pkg_installed_any akmod-nvidia akmod-nvidia-580xx akmod-nvidia-470xx akmod-nvidia-390xx; then
+    ok "NVIDIA: driver packages installed; the kmod builds at the next boot"
+else
+    ok "NVIDIA: none (no supported card, --nvidia=no, or no card present)"
+fi
 DM=$(detect_display_manager)
 ok "Display manager: ${DM:-none}"