fix: migration first-boot, fingerprint PAM, menus, mic LED

Post-migration annoyances from TuringMachine:

- Force fprintAuth from fingerprint.pam (NixOS defaults it on with fprintd)
- First-boot toast waits for swaync, retries, only marks after success
- Night light status/toggle handles masked units + hyprsunset/wlsunset
- VPN menu: define rofi_menu in nomarchy-vpn (was a silent no-op)
- Left arrow = ↩ Back in list menus; GTK menu contrast via Stylix
- Mic-mute LED udev + sync after wpctl; EasyEffects starts after tray
- Migration guide: HM before GUI login, fingerprint/browser/VPN notes

Verified: flake check --no-build; checks.first-boot; checks.hardware-toggles
(pam=false node). V3 session items pending after user rebuild.

pkgs/nomarchy-first-boot/nomarchy-first-boot.sh

@@ -19,13 +19,32 @@ case "$shown" in
   true|1|yes) exit 0 ;;
 esac
 
-# Dismissible sheet, not a wizard. Body lines match SUPER+? mnemonics.
-notify-send -a Nomarchy -u normal -t 0 \
-  "You're set" \
-  "SUPER+M  menu · SUPER+T  themes · SUPER+?  keys
+# Wait for the notification daemon (swaync). On first login the unit can
+# race graphical-session and get "Timeout was reached" from D-Bus — then
+# either no toast, or a toast that never lands while we still write the
+# marker. Retry notify-send; only persist the marker after a success.
+body="SUPER+M  menu · SUPER+T  themes · SUPER+?  keys
 Wi‑Fi: System › Network (or the bar tray)
 Anything off? System › Doctor"
 
+ok=
+i=0
+while [ "$i" -lt 8 ]; do
+  if notify-send -a Nomarchy -u normal -t 0 \
+      "You're set" \
+      "$body"; then
+    ok=1
+    break
+  fi
+  i=$((i + 1))
+  sleep 2
+done
+
+if [ -z "$ok" ]; then
+  # Leave firstBootShown alone so the next login can try again.
+  exit 1
+fi
+
 # Persist in the checkout so re-login is silent. --no-switch: marker only.
 if ! nomarchy-theme-sync --quiet set settings.firstBootShown true --no-switch; then
   # No writable flake checkout (or tool missing) — still showed the toast;