fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

docs/MIGRATION.md

@@ -226,14 +226,23 @@ Expect to resolve a few 25.11→26.05 option renames.
 # breaks, REBOOT and you are back in your old generation, untouched.
 sudo nixos-rebuild test --flake ~/nomarchy-migrate#default
 
-# Bring the desktop (home-manager) up:
-home-manager switch --flake ~/nomarchy-migrate#bernardo
+# Bring the desktop (home-manager) up BEFORE the first graphical login.
+# Hyprland without an HM generation shows the yellow "autogenerated
+# config" banner (and no Nomarchy theming) — finish this step first.
+home-manager switch --flake ~/nomarchy-migrate#bernardo -b bak
 ```
 
 Log into Hyprland and sanity‑check: Waybar renders, `SUPER+M` opens the
-menu, theming is coherent, `SUPER+?` shows the cheatsheet. Confirm the
-machine‑specific things you care about still work — suspend/hibernate, the
-AMD GPU (`vainfo` → radeonsi), display brightness.
+menu, theming is coherent, `SUPER+?` shows the cheatsheet, **no** yellow
+Hyprland autogenerated banner. Confirm the machine‑specific things you
+care about still work — suspend/hibernate, the AMD GPU (`vainfo` →
+radeonsi), display brightness.
+
+You should also get a one-shot **You're set** toast (menu / themes /
+keys). If it never appears: `systemctl --user status nomarchy-first-boot`
+and re-try with
+`nomarchy-theme-sync set settings.firstBootShown false --no-switch`
+then log out/in.
 
 If anything is wrong: **reboot → old generation.** Nothing is committed as
 default yet.
@@ -245,10 +254,26 @@ default yet.
 - **Power:** verify `powerprofilesctl get` works and the Waybar battery /
   power‑profile icons open the power menu. Your ryzenadj scripts are gone;
   if you miss a specific TDP behaviour, that's a follow‑up, not a blocker.
-- **Theme:** `nomarchy-menu theme` → pick **nord** (writes
+- **Theme:** `nomarchy-menu theme` → pick a preset (writes
   `theme-state.json`).
 - **Snapshots:** `nomarchy-menu` → System → Snapshots should see your
   existing `@snapshots` subvolume.
+- **Fingerprint:** `fingerprint.enable = true` only starts **fprintd**
+  (enrollment). Login/sudo finger auth is **`fingerprint.pam`** and is
+  opt-in — leave it commented until you've enrolled. NixOS defaults PAM
+  on whenever fprintd is enabled; Nomarchy forces PAM to follow the
+  `pam` flag, but only after a **system** rebuild. Verify with
+  `grep pam_fprintd /etc/pam.d/sudo` (should be empty when pam is off).
+- **Browser profiles:** Nomarchy does not manage Chromium/Firefox state.
+  Bookmarks/extensions live under `~/.config/chromium` (or
+  `~/.config/google-chrome` / ungoogled paths if that was your previous
+  browser). A package name change can look like "extensions vanished"
+  while bookmarks remain — point the new browser at the old profile dir
+  or re-install extensions; nothing was wiped by the activation.
+- **VPN:** NetworkManager connections survive under
+  `/etc/NetworkManager` and your home. System › VPN lists NM
+  `vpn`/`wireguard` profiles; import any that lived outside NM.
+  Tailscale is opt-in (`nomarchy.services.tailscale.enable`).
 - **Secrets/services:** if you relied on agenix‑managed secrets for a
   service, layer `agenix` back into `system.nix` as a machine‑specific
   import (Nomarchy doesn't manage secrets). If you don't need them, leave