fix(idle): don't lock before an encrypted hibernate (was: unlock after)

The previous nomarchy-hibernate-unlock ran `pkill hyprlock` after a
hibernate resume, but killing a Wayland session-lock client without
releasing the lock trips hyprlock's "go to a tty" crash failsafe -- the
compositor keeps the screen locked for safety. So resume showed a hyprlock
error screen instead of unlocking.

Fix it the right way: never engage the lock before an encrypted hibernate
(the LUKS passphrase at resume is the gate). Replace the post-resume unlock
with a nomarchy-lock-before-sleep unit that takes over hypridle's
before_sleep_cmd: it locks on the RAM-resume sleeps (suspend / hybrid-sleep
/ suspend-then-hibernate) always, and on hibernate.target only when the disk
is unencrypted. idle.nix drops before_sleep_cmd accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home/idle.nix

@@ -64,11 +64,13 @@ in
       settings = {
         general = {
           lock_cmd = "pidof hyprlock || hyprlock";
-          # Locks before every sleep. For suspend that's exactly right; on an
-          # encrypted hibernate the LUKS resume already gates the machine, so
-          # the system side dismisses this lock post-resume to avoid a double
-          # unlock — see nomarchy-hibernate-unlock in modules/nixos/default.nix.
-          before_sleep_cmd = "loginctl lock-session";
+          # No before_sleep_cmd here: locking before sleep is driven
+          # system-side so it can fire for suspend but skip an encrypted
+          # hibernate — whose LUKS resume already gates the machine, so a
+          # hyprlock on top is a second password (and a Wayland session-lock
+          # can't be safely dropped after the fact — killing the locker trips
+          # its "go to a tty" crash failsafe). See nomarchy-lock-before-sleep
+          # in modules/nixos/default.nix.
           after_sleep_cmd = "hyprctl dispatch dpms on";
         };
         listener = [