fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

modules/nixos/hardware.nix

@@ -193,12 +193,19 @@ in
     })
 
     # ── Fingerprint ────────────────────────────────────────────────────
+    # NixOS defaults security.pam.services.*.fprintAuth to
+    # services.fprintd.enable — so turning on fprintd alone would enable
+    # finger auth for login/sudo/greetd/passwd/… even when the user (or
+    # the migration template) left fingerprint.pam commented off. Force
+    # every interactive service we care about to follow our opt-in flag.
     (lib.mkIf cfg.fingerprint.enable {
       services.fprintd.enable = true;
-    })
-    (lib.mkIf (cfg.fingerprint.enable && cfg.fingerprint.pam) {
-      security.pam.services.login.fprintAuth = true;
-      security.pam.services.sudo.fprintAuth = true;
+      security.pam.services = lib.genAttrs [
+        "login" "sudo" "su" "greetd" "hyprlock" "sshd"
+        "passwd" "chsh" "chfn" "chpasswd"
+        "polkit-1" "swaylock"
+        "groupadd" "groupdel" "groupmod" "groupmems"
+      ] (_: { fprintAuth = cfg.fingerprint.pam; });
     })
 
     # ── Newest kernel for very-new hardware (opt-in escape hatch) ──────