feat(waybar,systemd-units): wire up new system-health modules and timers

Bar layout: insert the four new modules between custom/update and
custom/thunderbird so that all 'something needs your attention'
indicators live as a contiguous group on the right side, in roughly
escalating actionability:

  custom/notifications  -- mako history (always present, gray baseline)
  custom/update         -- '`just update` was N hours/days ago'
  custom/pacdiff        -- '.pacnew/.pacsave waiting'
  custom/arch-audit     -- 'fixable CVE in installed package'
  custom/failed-units   -- 'systemd unit failed'
  custom/lostfiles      -- 'unowned files under tracked dirs'
  custom/thunderbird    -- 'unread mail'

Click handlers all use the floating-ghostty + 'press enter to close'
idiom established by the existing update module so output stays
inspectable. arch-audit and lostfiles open their /run report in
`nvim -R` (read-only) since the source of truth lives in those files.

style.css: extend the shared 6px-padding selector list, the .fresh
zero-padding rule (so empty-state modules disappear cleanly), and add
.warn/.critical color rules consistent with the rest of the palette
(yellow #fabd2f for 'review when convenient', red #fb4934 for 'review
soon').

systemd-units/system.txt: enable the three new system timers
  - btrfs-balance@-.timer  (monthly partial balance on /)
  - arch-audit.timer       (daily CVE report refresh)
  - lostfiles.timer        (weekly unowned-files report refresh)

Picked up automatically on the next `just unit-apply`.

0 files changed, 0 insertions, 0 deletions