fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

flake.nix

@@ -489,15 +489,23 @@
           # what they SET (kernel cmdline, fprintd, PAM). Real hardware
           # behaviour (firmware/driver/device) needs bare metal and is out of
           # scope here. Imports only hardware.nix, so the VM stays minimal.
+          # Two nodes: pam=true must wire pam_fprintd; pam=false must NOT
+          # (NixOS defaults fprintAuth from fprintd.enable — we force off).
           hardware-toggles = pkgs.testers.runNixOSTest {
             name = "nomarchy-hardware-toggles";
-            nodes.machine = { ... }: {
-              imports = [ ./modules/nixos/hardware.nix ];
-              nomarchy.hardware = {
-                intel.enable = true;
-                amd.enable = true;
-                fingerprint = { enable = true; pam = true; };
-                npu.enable = true;
+            nodes = {
+              machine = { ... }: {
+                imports = [ ./modules/nixos/hardware.nix ];
+                nomarchy.hardware = {
+                  intel.enable = true;
+                  amd.enable = true;
+                  fingerprint = { enable = true; pam = true; };
+                  npu.enable = true;
+                };
+              };
+              nopam = { ... }: {
+                imports = [ ./modules/nixos/hardware.nix ];
+                nomarchy.hardware.fingerprint = { enable = true; pam = false; };
               };
             };
             testScript = ''
@@ -507,6 +515,11 @@
               assert "i915.enable_guc=3" in cmdline, cmdline
               machine.succeed("systemctl cat fprintd.service")
               machine.succeed("grep -q pam_fprintd /etc/pam.d/sudo")
+
+              nopam.wait_for_unit("multi-user.target")
+              nopam.succeed("systemctl cat fprintd.service")
+              nopam.fail("grep -q pam_fprintd /etc/pam.d/sudo")
+              nopam.fail("grep -q pam_fprintd /etc/pam.d/login")
             '';
           };