fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

modules/home/first-boot.nix

@@ -11,8 +11,18 @@
       Unit = {
         Description = "Nomarchy first-session welcome toast";
         PartOf = [ "graphical-session.target" ];
-        # After the session (and preferably the notification daemon) is up.
-        After = [ "graphical-session.target" "graphical-session-pre.target" ];
+        # After the session AND the notification daemon. Without
+        # After=swaync, first login races D-Bus Notifications and the
+        # toast times out (migration: journal "Timeout was reached") —
+        # or worse, a later success writes firstBootShown without the
+        # user ever seeing the toast. Wants= so we still run if swaync
+        # is disabled (notify-send will fail and leave the marker unset).
+        After = [
+          "graphical-session.target"
+          "graphical-session-pre.target"
+          "swaync.service"
+        ];
+        Wants = [ "swaync.service" ];
       };
       Service = {
         Type = "oneshot";
@@ -27,8 +37,8 @@
           ]}"
           "NOMARCHY_PATH=%h/.nomarchy"
         ];
-        # Brief settle so swaync is accepting toasts (live ISO uses sleep 3).
-        ExecStartPre = "${pkgs.coreutils}/bin/sleep 2";
+        # Brief settle after swaync is up; the script also retries.
+        ExecStartPre = "${pkgs.coreutils}/bin/sleep 1";
         ExecStart = "${pkgs.nomarchy-first-boot}/bin/nomarchy-first-boot";
       };
       Install.WantedBy = [ "graphical-session.target" ];