feat(waybar,systemd-units): wire up new system-health modules and timers

Bar layout: insert the four new modules between custom/update and
custom/thunderbird so that all 'something needs your attention'
indicators live as a contiguous group on the right side, in roughly
escalating actionability:

  custom/notifications  -- mako history (always present, gray baseline)
  custom/update         -- '`just update` was N hours/days ago'
  custom/pacdiff        -- '.pacnew/.pacsave waiting'
  custom/arch-audit     -- 'fixable CVE in installed package'
  custom/failed-units   -- 'systemd unit failed'
  custom/lostfiles      -- 'unowned files under tracked dirs'
  custom/thunderbird    -- 'unread mail'

Click handlers all use the floating-ghostty + 'press enter to close'
idiom established by the existing update module so output stays
inspectable. arch-audit and lostfiles open their /run report in
`nvim -R` (read-only) since the source of truth lives in those files.

style.css: extend the shared 6px-padding selector list, the .fresh
zero-padding rule (so empty-state modules disappear cleanly), and add
.warn/.critical color rules consistent with the rest of the palette
(yellow #fabd2f for 'review when convenient', red #fb4934 for 'review
soon').

systemd-units/system.txt: enable the three new system timers
  - btrfs-balance@-.timer  (monthly partial balance on /)
  - arch-audit.timer       (daily CVE report refresh)
  - lostfiles.timer        (weekly unowned-files report refresh)

Picked up automatically on the next `just unit-apply`.

2 files changed, 61 insertions, 1 deletions

diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc
index a6614f9..12d1255 100644
--- a/dot_config/waybar/config.jsonc
+++ b/dot_config/waybar/config.jsonc
@@ -21,6 +21,10 @@
     "idle_inhibitor",
     "custom/notifications",
     "custom/update",
+    "custom/pacdiff",
+    "custom/arch-audit",
+    "custom/failed-units",
+    "custom/lostfiles",
     "custom/thunderbird",
     "clock",
     "tray",
@@ -219,6 +223,38 @@
     "tooltip": true,
   },
 
+  "custom/pacdiff": {
+    "exec": "~/.config/waybar/pacdiff-status.sh",
+    "return-type": "json",
+    "interval": 300,
+    "on-click": "ghostty --class=floating -e sh -c 'sudo DIFFPROG=\"nvim -d\" pacdiff; printf \"\\n[done — press enter] \"; read _'",
+    "tooltip": true,
+  },
+
+  "custom/failed-units": {
+    "exec": "~/.config/waybar/failed-units-status.sh",
+    "return-type": "json",
+    "interval": 30,
+    "on-click": "ghostty --class=floating -e sh -c 'echo \"=== system ===\"; systemctl --failed; echo; echo \"=== user ===\"; systemctl --user --failed; printf \"\\n[done — press enter] \"; read _'",
+    "tooltip": true,
+  },
+
+  "custom/arch-audit": {
+    "exec": "~/.config/waybar/arch-audit-status.sh",
+    "return-type": "json",
+    "interval": 300,
+    "on-click": "ghostty --class=floating -e nvim -R /run/arch-audit.txt",
+    "tooltip": true,
+  },
+
+  "custom/lostfiles": {
+    "exec": "~/.config/waybar/lostfiles-status.sh",
+    "return-type": "json",
+    "interval": 600,
+    "on-click": "ghostty --class=floating -e nvim -R /run/lostfiles.txt",
+    "tooltip": true,
+  },
+
   "custom/thunderbird": {
     "exec": "~/.config/waybar/tb-unread.sh",
     "return-type": "json",
diff --git a/dot_config/waybar/style.css b/dot_config/waybar/style.css
index cb4dd86..fe2f3bb 100644
--- a/dot_config/waybar/style.css
+++ b/dot_config/waybar/style.css
@@ -61,11 +61,19 @@ window#waybar {
 #custom-dock,
 #custom-notifications,
 #custom-update,
+#custom-pacdiff,
+#custom-failed-units,
+#custom-arch-audit,
+#custom-lostfiles,
 #custom-thunderbird {
   padding: 0 6px;
 }
 
-#custom-update.fresh {
+#custom-update.fresh,
+#custom-pacdiff.fresh,
+#custom-failed-units.fresh,
+#custom-arch-audit.fresh,
+#custom-lostfiles.fresh {
   padding: 0;
 }
 
@@ -77,6 +85,22 @@ window#waybar {
   color: #fb4934; /* red — stale ≥ 7d */
 }
 
+#custom-pacdiff.warn {
+  color: #fabd2f; /* yellow — .pacnew/.pacsave waiting */
+}
+
+#custom-failed-units.critical {
+  color: #fb4934; /* red — at least one failed unit */
+}
+
+#custom-arch-audit.critical {
+  color: #fb4934; /* red — fixable CVEs in installed packages */
+}
+
+#custom-lostfiles.warn {
+  color: #fabd2f; /* yellow — unowned files under tracked dirs */
+}
+
 #cpu {
   color: #83a598; /* blue */
 }