feat(installer): grant brightness control to the video group

Arch's brightnessctl ships no udev rules and leans on logind, which grants brightness writes only to the active seat session. Anything outside that session (a script, an ssh shell, a panel launched into a different one) meets root-owned sysfs and gets EPERM. On velox both panel sliders were dead after a fresh install.

configure_backlight_access writes a udev rule making the backlight and keyboard-LED brightness attributes group-writable by video, which create_user already adds the user to. I granted the keyboard LED to video rather than input: anyone in input can read every input device, which is too much authority for dimming a keyboard.

essential_services is already marked complete on machines installed before this step, so a re-run skips them. The post-install checklist carries the manual route.

1 files changed, 29 insertions, 0 deletions

diff --git a/docs/post-install-checklist.org b/docs/post-install-checklist.org
index fa704b6..97fc0d5 100644
--- a/docs/post-install-checklist.org
+++ b/docs/post-install-checklist.org
@@ -37,6 +37,35 @@ Trusted devices reconnect on their own after reboot; if one doesn't, check
 =rfkill list= first (radios should be unblocked — TLP owns radio state and
 enables bluetooth/wifi at startup per =/etc/tlp.d/01-custom.conf=).
 
+** Brightness control on a machine installed before 2026-08-13
+
+Only for a machine whose install predates =configure_backlight_access=. New
+installs get the rule automatically, and a re-run of =archsetup= skips the
+step because =essential_services= is already marked complete, so an older
+machine needs one of these by hand:
+
+#+begin_src bash
+# either drop the rule in directly...
+sudo tee /etc/udev/rules.d/90-backlight.rules > /dev/null << 'EOF'
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/usr/bin/chgrp video /sys/class/backlight/%k/brightness"
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/usr/bin/chmod g+w /sys/class/backlight/%k/brightness"
+ACTION=="add", SUBSYSTEM=="leds", KERNEL=="*kbd_backlight", RUN+="/usr/bin/chgrp video /sys/class/leds/%k/brightness"
+ACTION=="add", SUBSYSTEM=="leds", KERNEL=="*kbd_backlight", RUN+="/usr/bin/chmod g+w /sys/class/leds/%k/brightness"
+EOF
+sudo udevadm control --reload
+sudo udevadm trigger --subsystem-match=backlight --action=add
+sudo udevadm trigger --subsystem-match=leds --action=add
+
+# ...or clear the marker and re-run just that step
+sudo rm /var/lib/archsetup/state/essential_services
+#+end_src
+
+Verify: =ls -l /sys/class/backlight/*/brightness= shows group =video= with
+=g+w=, and =brightnessctl -c backlight set 70%= succeeds without sudo.
+
+Only laptops have these devices; on a desktop the rule is inert and nothing
+needs doing.
+
 ** Proton Mail Bridge (cmail)
 
 The installer's completion message carries the steps; recorded here too so