fix(desktop): keep launcher apps out of the bar's cgroup

Quickshell has no scope support of its own, so apps started from its
launcher inherited the cgroup of quickshell.service and systemd killed
them along with the unit on every restart — a rebuild that rewrites the
unit was enough, and Librewolf counted each one as a crash until it
refused to restore the session. app2unit is the start prefix the QML now
uses; see moonarch's LauncherPopout.qml.

The unit also gained a start limit. After a rebuild sent niri SIGTERM,
graphical-session.target stayed up while the Wayland socket was gone, so
Restart=on-failure spun 32 times in two minutes against a dead display.
Three tries per 30s ends that; the window slides, so a single crash after
a normal run still gets its restart.

modules/services.nix

@@ -159,6 +159,18 @@ in
     # this file. As a spawn-at-startup it inherited the session PATH; the unit
     # gets the same set rather than a list that goes stale on the next widget.
     path = [ config.system.path ];
+    # Restart=on-failure alone spun 32 times through a dead Wayland socket after
+    # a rebuild had sent niri SIGTERM: graphical-session-pre.target went down,
+    # graphical-session.target stayed up, so the unit was still wanted and every
+    # attempt died on "no Qt platform plugin could be initialized". Quickshell
+    # refuses a relaunch itself ("crashed within 10 seconds"), but systemd never
+    # reached the default limit of 5 starts per 10s at a 3s delay. Three tries
+    # per 30s ends it after ~9s. The window slides, so a single crash after a
+    # normal run still gets its restart — the point of running this as a unit.
+    unitConfig = {
+      StartLimitIntervalSec = 30;
+      StartLimitBurst = 3;
+    };
     serviceConfig = {
       Type = "simple";
       ExecStart = "${lib.getExe pkgs.quickshell} -c moonarch";