fix(keyboard): carry the configured layout to the LUKS prompt

Setting only services.xserver.xkb.layout moves the graphical session but
leaves console.useXkbConfig unset, so the virtual-console keymap -- and the
systemd initrd the LUKS passphrase prompt runs in -- fall back to US (seen
on a Latitude 5410: X11 Layout gb, VC Keymap unset, LUKS prompt US).

Default console.useXkbConfig + console.earlySetup + boot.initrd.systemd.enable
distro-wide, so xkb.layout alone reaches the console and the encrypted-disk
prompt. Moved the latter two out of plymouth.nix -- they no longer hinge on
the splash being enabled. All mkDefault: an explicit console.keyMap or a
scripted initrd still wins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -50,6 +50,25 @@ in
     # `nixpkgs.config = lib.mkForce { allowUnfree = false; }`.
     nixpkgs.config.allowUnfree = true;
 
+    # ── One keyboard layout everywhere, incl. the LUKS prompt ────────
+    # services.xserver.xkb.layout is the single source of truth for the
+    # layout (the installer writes it; downstream sets it in system.nix).
+    # These bridge that one knob through to the encrypted-disk prompt —
+    # without them, setting only xkb.layout moves the graphical session
+    # but leaves the console keymap unset, so the initrd LUKS passphrase
+    # prompt falls back to US:
+    #   useXkbConfig    the virtual-console keymap follows xkb (TTYs)
+    #   earlySetup      bakes that keymap into the initrd
+    #   systemd initrd  loads it before cryptsetup asks for the passphrase
+    #                   (the legacy scripted initrd cannot; also what
+    #                   Plymouth needs — defaulted here so it no longer
+    #                   hinges on the splash being enabled).
+    # All mkDefault, so an explicit console.keyMap or a scripted initrd
+    # still wins.
+    console.useXkbConfig = lib.mkDefault true;
+    console.earlySetup = lib.mkDefault true;
+    boot.initrd.systemd.enable = lib.mkDefault true;
+
     # ── Wayland session: Hyprland ────────────────────────────────────
     # Installs the binary, registers the session, wires up
     # xdg-desktop-portal-hyprland. Configuration is Home Manager's job.

modules/nixos/plymouth.nix

@@ -80,11 +80,12 @@ let
 in
 {
   config = lib.mkIf cfg.plymouth.enable {
-    # Plymouth wants the systemd initrd (also what applies the keyboard
+    # The systemd initrd (boot.initrd.systemd.enable) and console.earlySetup
-    # layout to the LUKS prompt) and a quiet console around it.
+    # that Plymouth needs are now distro-wide defaults in ./default.nix
-    boot.initrd.systemd.enable = lib.mkDefault true;
+    # (they also carry the keyboard layout to the LUKS prompt), so the
+    # splash no longer has to turn them on. Just keep the console quiet
+    # around the splash.
     boot.initrd.verbose = lib.mkDefault false;
-    console.earlySetup = lib.mkDefault true;
     boot.consoleLogLevel = lib.mkDefault 0;
 
     boot.plymouth = {