docs(fingerprint): parallel prompt in HARDWARE.md §5 + MIGRATION note

The feature commit updated the README table, template, ROADMAP and
HARDWARE-QUEUE but missed the canonical user-facing page: HARDWARE.md
§5 gets a "Parallel prompt" subsection (default, opt-out, structural
lockout safety, grep to verify, known leftover-prompt quirk) and the
option-summary table row; MIGRATION.md's fingerprint bullet points at
it. Doc-only, V0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/HARDWARE.md

@@ -167,6 +167,7 @@ Elan, …) via `lsusb` or `/sys/bus/usb/.../idVendor`. On hit:
 ```nix
 nomarchy.hardware.fingerprint.enable = true;  # services.fprintd
 # nomarchy.hardware.fingerprint.pam = true;   # login + sudo (opt-in)
+# nomarchy.hardware.fingerprint.parallel = false;  # sequential prompt instead
 ```
 
 ### Enroll (menu or CLI)
@@ -190,6 +191,21 @@ fprintd-list "$USER"
 PAM stays opt-in on purpose: password-only remains the cautious default
 until a finger is enrolled. Full enroll on a real reader is V3/hardware.
 
+### Parallel prompt (password *or* finger, whichever first)
+
+With `fingerprint.pam` on, sudo/login/hyprlock show **one** prompt that
+accepts either factor — type the password or touch the sensor
+(2026-07-12; `pam-fprint-grosshack`, an fprintd fork, since stock PAM
+can't express parallel factors). This is the default;
+`fingerprint.parallel = false` restores stock pam_fprintd's sequential
+wait-for-the-reader-then-password. Lockout safety is structural: the
+module never validates passwords itself — a typed password is handed to
+the normal `pam_unix` rule, and every failure (no reader, fprintd hung,
+timeout) falls through to password, so finger auth can only ever *add* a
+way in. Verify the wiring with
+`grep pam_fprintd_grosshack /etc/pam.d/sudo`. Known cosmetic quirk: after
+a fingerprint win a leftover password prompt may linger on the console.
+
 ### Doctor
 
 `nomarchy-doctor` reports fprintd unit + enroll status when present.
@@ -438,7 +454,7 @@ Full tables: [README § options](../README.md). Hardware-shaped surface:
 | `mkFlake.hardwareProfile` | nixos-hardware name or list |
 | `nomarchy.hardware.intel.enable` / `.guc` / `.computeRuntime` | Intel gap layer |
 | `nomarchy.hardware.amd.enable` / `.pstate` / `.vaapi` / `.rocm.*` | AMD gap layer |
-| `nomarchy.hardware.fingerprint.enable` / `.pam` | fprintd + PAM |
+| `nomarchy.hardware.fingerprint.enable` / `.pam` / `.parallel` | fprintd + PAM (parallel password-or-finger prompt by default) |
 | `nomarchy.hardware.npu.enable` | in-kernel NPU only |
 | `nomarchy.hardware.latestKernel` | `linuxPackages_latest` |
 | `nomarchy.hardware.camera.hideIrSensor` / `.irMatch` | dual-sensor webcams (v4l2 only; §7) |

docs/MIGRATION.md

@@ -269,6 +269,9 @@ default yet.
   on whenever fprintd is enabled; Nomarchy forces PAM to follow the
   `pam` flag, but only after a **system** rebuild. Verify with
   `grep pam_fprintd /etc/pam.d/sudo` (should be empty when pam is off).
+  With pam on, the prompt accepts password *or* finger in parallel by
+  default (`fingerprint.parallel = false` for stock sequential) — see
+  HARDWARE.md §5.
 - **Browser profiles:** Nomarchy does not manage Chromium/Firefox state.
   Bookmarks/extensions live under `~/.config/chromium` (or
   `~/.config/google-chrome` / ungoogled paths if that was your previous