fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

modules/home/default.nix

@@ -40,7 +40,16 @@
   services.udiskie.enable = true;
 
   # Microphone noise cancellation (rnnoise) and audio EQ.
+  # Tray icon is built into EasyEffects 8 (Qt StatusNotifierItem); the
+  # daemon must start after a tray host (Waybar) or the icon is missing
+  # for the whole session (wwmm/easyeffects#4636).
   services.easyeffects.enable = true;
+  systemd.user.services.easyeffects = {
+    Unit = {
+      After = [ "graphical-session.target" "tray.target" "waybar.service" ];
+      Wants = [ "tray.target" ];
+    };
+  };
 
   # Wifi from the bar: nm-applet lives in waybar's tray (SNI flag via
   # preferStatusNotifierItems — without it there is no tray icon).