feat: add sysext feature selection page to first-boot setup

[bketelsen]

Closes #27

What

Adds an Extensions page to the configure-system (first-boot) flow, between the user page and the core-progress page, letting the user pick which sysext features to enable. Selected features are enabled and downloaded with updex (per the issue comment — not systemd-sysupdate) before the first GNOME login, so desktop apps appear in the app grid without a re-login and services (docker, incus, tailscale) activate on merge.

How

• Discovery: backend.list_sysext_features() parses <name>.feature files from the sysupdate.d directories (/etc, /run, /usr/local/lib, /usr/lib), including .feature.d/*.conf drop-in overrides with systemd-style precedence — so the enablement drop-ins updex writes to /etc/sysupdate.d/<name>.feature.d/00-updex.conf are reflected in the switch state. Output verified identical to updex features list --json.
• Curation: a Recommended group (edge, vscode, bitwarden — what the loaded variants used to bake in) with switches on by default, and a collapsed More Extensions expander with everything else off by default. The page is skipped entirely on images that ship no .feature files.
• Enable + download: each selected feature becomes a deferred action running the new sysext-features pkexec script (updex --silent features enable <name> --now), one action per feature so the existing core-progress page shows a per-feature progress row. updex runs systemd-sysext refresh after install, so merges happen during setup.
• Polkit action added for the new script; the existing snow-first-setup group rule covers it without a prompt.

Design note on backgrounding

The issue suggests backgrounding the downloads if possible. Downloads run on the core-progress page (alongside the core flatpaks) with per-item progress rather than truly in the background: the configure-system flow ends in a logout, which would kill pkexec children of the session. Everything therefore completes, visibly, before the logout page.

Verification

• meson compile succeeds (54/54 targets), gresource compiles with the new UI
• Discovery parser output matches updex features list --json exactly on a live snowfield system (11 features, enabled states correct)
• Headless GTK harness: page constructs, recommended/expander grouping and switch defaults correct; finish() queues exactly the checked features and re-finishing after unchecking removes stale entries
• sudo updex --silent --dry-run features enable docker --now → "Would enable feature 'docker' and download extensions"
• App launches cleanly in test.py -d -c (dry-run configure mode)

🤖 Generated with Claude Code