feat(global_defaults): firmware/gpu/peripherals/hardware schema

roles/global_defaults/defaults/main.yml

@@ -144,6 +144,19 @@ system_defaults:
     secure_boot:
       enabled: false
       method: ""            # arch only: sbctl (default) or uki; ignored for other distros
+    firmware:
+      enabled: "auto"       # auto = on for physical, off for virtual
+      microcode: "auto"
+    gpu:
+      enabled: false
+      nvidia_driver: "auto" # auto | open | proprietary | nouveau
+    peripherals:
+      enabled: "auto"       # auto = follows desktop.enabled
+      fingerprint: "auto"
+      webcam: "auto"
+      displaylink: false
+    hardware:
+      profile: {}           # empty = autodetect; set to override (golden image)
 
 # Per-hypervisor required fields — drives data-driven validation.
 # All virtual types additionally require network bridge or interfaces.