fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

modules/home/hyprland.nix

@@ -20,14 +20,29 @@ let
   # --custom-progress is the mic level (0.0-1.0), --custom-icon the
   # muted/active glyph. Pure bash builtins for parsing so the script needs no
   # PATH beyond the two pinned tools.
+  #
+  # Hardware mic-mute LEDs (ThinkPad platform::micmute, HDA *::micmute, …)
+  # are driven by the kernel's audio-micmute trigger, which tracks ALSA —
+  # not PipeWire software mute. Sync the LED from the resulting mute state
+  # when the node is group-writable (udev rule in modules/nixos/default.nix).
   micMute = pkgs.writeShellScript "nomarchy-mic-mute" ''
     ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_SOURCE@ toggle
     out=$(${pkgs.wireplumber}/bin/wpctl get-volume @DEFAULT_SOURCE@)
     set -- $out            # "Volume: 0.85 [MUTED]" -> $2 is the level
     case "$out" in
-      *MUTED*) icon=microphone-sensitivity-muted-symbolic ;;
-      *)       icon=microphone-sensitivity-high-symbolic ;;
+      *MUTED*) icon=microphone-sensitivity-muted-symbolic; led=1 ;;
+      *)       icon=microphone-sensitivity-high-symbolic; led=0 ;;
     esac
+    for led_dir in /sys/class/leds/*micmute* /sys/class/leds/*::micmute; do
+      [ -e "$led_dir/brightness" ] || continue
+      if [ -w "$led_dir/brightness" ]; then
+        # Drop the kernel trigger so a stuck audio-micmute state cannot
+        # override our write (verified: ALSA Capture mute alone does not
+        # flip platform::micmute on ThinkPad T14s).
+        [ -w "$led_dir/trigger" ] && echo none > "$led_dir/trigger" 2>/dev/null || true
+        echo "$led" > "$led_dir/brightness" 2>/dev/null || true
+      fi
+    done
     ${pkgs.swayosd}/bin/swayosd-client --custom-icon "$icon" --custom-progress "$2"
   '';
 
@@ -446,6 +461,10 @@ in
       ];
 
       misc = {
+        # Kill the water-drop splash + the yellow "autogenerated config"
+        # banner. Migrations that log into Hyprland before the first
+        # home-manager switch still see the banner (no managed conf yet) —
+        # see docs/MIGRATION.md. Once HM owns hyprland.conf these stay off.
         disable_hyprland_logo = lib.mkDefault true;
         disable_splash_rendering = lib.mkDefault true;
         force_default_wallpaper = lib.mkDefault 0;