t480: wake from suspend via built-in-USB keyboard

Add a udev rule (t480UsbWakeup) that arms USB remote-wakeup for a keyboard
on the built-in xHCI controller (00:14.0), so pressing a key wakes the T480
from S3. The dock connects over the Thunderbolt-3 controller (3c:00.0), which
powers down in S3 and cannot detect a cold replug, so dock-connected input
cannot wake the machine after an unplug-triggered suspend; a built-in-port
keyboard can. Match the keyboard by VID:PID since its USB bus path is unstable.

Also wires up the logind lid-switch policy (suspend undocked, ignore docked)
for the clamshell workflow.

modules/hosts/t480/default.nix

@@ -19,6 +19,12 @@
       obsidian
       discord
       gaming
+      winbox
+      cad
+      prusa-slicer
+      netops
+      via
+      t480UsbWakeup
     ];
   };
 }

modules/hosts/t480/t480Configuration.nix

@@ -7,6 +7,13 @@
     networking = {
       hostName = "t480";
     };
+    services.logind = {
+      lidSwitch = "suspend";
+      lidSwitchDocked = "ignore";
+    };
+    services.fwupd = {
+      enable = true;
+    };
   };
 }
 

modules/hosts/t480/usb-wakeup.nix

@@ -0,0 +1,18 @@
+{...}: {
+  flake.nixosModules.t480UsbWakeup = {...}: {
+    services.udev.extraRules = ''
+      # Wake the T480 from S3 suspend via a keyboard plugged into a built-in USB
+      # port. The dock connects over the Thunderbolt-3 controller (3c:00.0), which
+      # powers down in S3 and cannot detect a cold replug — so dock-connected input
+      # cannot wake the machine after an unplug-triggered suspend. The built-in xHCI
+      # (00:14.0) stays wake-capable in S3, so a keyboard on a built-in port works.
+      #
+      # Arm the built-in xHCI root hubs (idVendor 1d6b = Linux Foundation root hub),
+      # scoped to the built-in controller so the TB3 root hubs are left untouched.
+      ACTION=="add", SUBSYSTEM=="usb", KERNELS=="0000:00:14.0", ATTR{idVendor}=="1d6b", ATTR{power/wakeup}="enabled"
+      # Arm the IQUNIX MQ80 keyboard itself. Match by VID:PID — the USB bus path
+      # is unstable across re-enumeration, so path-based matching is unreliable.
+      ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="320f", ATTR{idProduct}=="5055", ATTR{power/wakeup}="enabled"
+    '';
+  };
+}