fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

modules/home/nightlight.nix

@@ -45,29 +45,42 @@ let
       v=$(${sync} get settings.nightlight.on 2>/dev/null) || v=${onDefault}
       case "$v" in true|True) return 0 ;; *) return 1 ;; esac
     }
-    installed() { systemctl --user cat "$unit" >/dev/null 2>&1; }
-    start() { systemctl --user start "$unit" 2>/dev/null || true; }
+    # LoadState=loaded means a real unit (not the empty-file mask HM/packages
+    # leave behind for unused hyprsunset). `systemctl cat` alone succeeds on
+    # a masked unit and wrongly reported "installed" → silent no-op start.
+    installed() {
+      [ "$(systemctl --user show -p LoadState --value "$unit" 2>/dev/null)" = loaded ]
+    }
+    active() { systemctl --user is-active --quiet "$unit" 2>/dev/null; }
+    start() {
+      systemctl --user daemon-reload 2>/dev/null || true
+      systemctl --user unmask "$unit" 2>/dev/null || true
+      systemctl --user start "$unit" 2>/dev/null || true
+    }
     stop()  { systemctl --user stop  "$unit" 2>/dev/null || true; }
     case "''${1:-toggle}" in
       should-start) is_on ;;                       # ExecCondition gate (login/reboot)
       status)
         # Waybar (polls every 3s): moon while running; print nothing otherwise so
-        # the module self-hides — enable / re-enable from the System menu.
-        systemctl --user is-active --quiet "$unit" \
+        # the module self-hides — enable / re-enable from Look & Feel.
+        # `active` alone is the truth for the moon; menu labels use the same.
+        active \
           && printf '{"text":"󰖔","tooltip":"Night light on — ${if geo then "follows your location" else "warm on schedule"} (click to disable)","class":"on"}\n'
         exit 0 ;;
+      # Plain on/off string for menus (hyprsunset OR wlsunset; not hard-coded).
+      is-active) if active; then echo on; else echo off; fi ;;
       on)
         if installed; then write_on true; start; else install_feature; start; fi ;;
       off) write_on false; stop ;;
       toggle)
-        if systemctl --user is-active --quiet "$unit"; then
+        if active; then
           write_on false; stop                     # on -> off (instant)
         elif installed; then
           write_on true; start                     # installed, off -> on (instant)
         else
           install_feature; start                   # first enable (rebuilds)
         fi ;;
-      *) echo "usage: nomarchy-nightlight [toggle|status|on|off|should-start]" >&2; exit 64 ;;
+      *) echo "usage: nomarchy-nightlight [toggle|status|on|off|should-start|is-active]" >&2; exit 64 ;;
     esac
   '';
 in