t480: wake from suspend via built-in-USB keyboard

Add a udev rule (t480UsbWakeup) that arms USB remote-wakeup for a keyboard
on the built-in xHCI controller (00:14.0), so pressing a key wakes the T480
from S3. The dock connects over the Thunderbolt-3 controller (3c:00.0), which
powers down in S3 and cannot detect a cold replug, so dock-connected input
cannot wake the machine after an unplug-triggered suspend; a built-in-port
keyboard can. Match the keyboard by VID:PID since its USB bus path is unstable.

Also wires up the logind lid-switch policy (suspend undocked, ignore docked)
for the clamshell workflow.

modules/hosts/t480/t480Configuration.nix

@@ -7,6 +7,13 @@
     networking = {
       hostName = "t480";
     };
+    services.logind = {
+      lidSwitch = "suspend";
+      lidSwitchDocked = "ignore";
+    };
+    services.fwupd = {
+      enable = true;
+    };
   };
 }