feat(install): LUKS by default → auto-login, snapper snapshots, hibernation swapfile

- LUKS2 is the installer default; in exchange the generated config sets
  the new nomarchy.system.greeter.autoLogin (greetd initial_session) —
  the disk passphrase already gates the machine.
- @snapshots subvolume + nomarchy.system.snapper.enable: hourly/daily
  timeline snapshots of / and the nixos-rebuild-snap helper, ported from
  the previous iteration (3bdfc35), guarded to no-op on non-BTRFS roots.
- @swap subvolume with a swapfile sized to RAM by default (disko
  mkswapfile handles NOCOW); the installer computes the resume offset
  and wires boot.resumeDevice + resume_offset for hibernation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/TESTING.md

@@ -77,11 +77,13 @@ terminal:
 ```sh
 sudo NOMARCHY_UNATTENDED=1 NOMARCHY_DISK=/dev/vda \
      NOMARCHY_USERNAME=me NOMARCHY_PASSWORD=test \
+     NOMARCHY_LUKS_PASSPHRASE=testtest1 \
      NOMARCHY_FINISH=poweroff nomarchy-install
 ```
 
-Then boot the VM again **from the target disk** (drop `-cdrom`). The
-machine must reach the themed desktop on its own — greeter autostart,
+Then boot the VM again **from the target disk** (drop `-cdrom`). After
+typing the LUKS passphrase at the initrd prompt, the machine must reach
+the themed desktop **without a login prompt** (LUKS implies auto-login) —
 wallpaper, Waybar — and `nomarchy-theme-sync apply <x>` must work. For the
 offline claim, add `restrict=on` to the `-netdev` and re-run the whole
 flow: it must behave identically (requires an ISO built from a clean git