Install only the helper scripts that are still called

cpugov, sink-switcher and nightlight were referenced solely by the waybar
config; the Quickshell popouts cover all three. btnote, capsnote, vpn and
waybar-hidpp are unreferenced anywhere.

Adds the two system units for battery threshold restore and camera
shutoff, which had been missed.

modules/services.nix

@@ -1,5 +1,5 @@
-# ABOUTME: systemd user and system services for the Moonarch session.
-# ABOUTME: Rebuilt from defaults/etc/systemd/ because the units use FHS paths.
+# ABOUTME: systemd system and user services for the desktop session.
+# ABOUTME: Rebuilt from moonarch/defaults/etc/systemd/, whose units use FHS paths.
 
 { pkgs, lib, moonarchPkgs, ... }:
 
@@ -45,6 +45,52 @@
     };
   };
 
+  # --- System services from defaults/etc/systemd/system/ ---
+  #
+  # Rebuilt rather than copied, same reason as the user units: the originals
+  # reference /usr/bin.
+
+  systemd.services.moonarch-batsaver = {
+    description = "Restore battery conservation mode threshold";
+    after = [ "sysinit.target" ];
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExists = [
+      "/sys/class/power_supply/BAT0/charge_control_end_threshold"
+      "/var/lib/moonarch/batsaver-threshold"
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${moonarchPkgs.moonarch-scripts}/bin/moonarch-batsaver-restore";
+      NoNewPrivileges = true;
+      ProtectHome = true;
+      PrivateTmp = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      LockPersonality = true;
+    };
+  };
+
+  systemd.services.moonarch-camera = {
+    description = "Switch off all cameras on boot";
+    after = [ "sysinit.target" ];
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExistsGlob = "/sys/class/video4linux/video*";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${moonarchPkgs.moonarch-scripts}/bin/moonarch-camera-boot";
+      NoNewPrivileges = true;
+      ProtectHome = true;
+      PrivateTmp = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      LockPersonality = true;
+    };
+  };
+
   # Upstream ships a unit in the Arch package but not in the tarball, so it is
   # declared here. Mirrors /usr/lib/systemd/user/stasis.service.
   systemd.user.services.stasis = {
@@ -89,7 +135,7 @@
 
   # Night light stays disabled by default: it is a user toggle. Enabling it
   # here would create a system-scope symlink that overrides any
-  # `systemctl --user disable` — same reasoning as in moonarch-git/PKGBUILD.
+  # `systemctl --user disable`.
   systemd.user.services.wlsunset = {
     description = "Wlsunset night light (blue light filter)";
     partOf = [ "graphical-session.target" ];