feat(install): LUKS by default → auto-login, snapper snapshots, hibernation swapfile

- LUKS2 is the installer default; in exchange the generated config sets
  the new nomarchy.system.greeter.autoLogin (greetd initial_session) —
  the disk passphrase already gates the machine.
- @snapshots subvolume + nomarchy.system.snapper.enable: hourly/daily
  timeline snapshots of / and the nixos-rebuild-snap helper, ported from
  the previous iteration (3bdfc35), guarded to no-op on non-BTRFS roots.
- @swap subvolume with a swapfile sized to RAM by default (disko
  mkswapfile handles NOCOW); the installer computes the resume offset
  and wires boot.resumeDevice + resume_offset for hibernation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -26,9 +26,16 @@ in
 
     services.greetd = lib.mkIf cfg.greeter.enable {
       enable = lib.mkDefault true;
-      settings.default_session = {
-        command = lib.mkDefault "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd Hyprland";
-        user = "greeter";
+      settings = {
+        default_session = {
+          command = lib.mkDefault "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd Hyprland";
+          user = "greeter";
+        };
+        # Boot straight into the session once; logout → normal greeter.
+        initial_session = lib.mkIf (cfg.greeter.autoLogin != null) {
+          command = "Hyprland";
+          user = cfg.greeter.autoLogin;
+        };
       };
     };
 
@@ -53,6 +60,24 @@ in
     hardware.bluetooth.enable = lib.mkDefault cfg.bluetooth.enable;
     services.blueman.enable = lib.mkDefault cfg.bluetooth.enable;
 
+    # ── BTRFS timeline snapshots (ported from the previous iteration) ─
+    # Guarded on the actual filesystem so enabling it on an ext4 machine
+    # is a clean no-op rather than a failing timer.
+    services.snapper.configs = lib.mkIf
+      (cfg.snapper.enable && (config.fileSystems."/".fsType or "") == "btrfs")
+      {
+        root = {
+          SUBVOLUME = "/";
+          TIMELINE_CREATE = true;
+          TIMELINE_CLEANUP = true;
+          TIMELINE_LIMIT_HOURLY = "5";
+          TIMELINE_LIMIT_DAILY = "7";
+          TIMELINE_LIMIT_WEEKLY = "0";
+          TIMELINE_LIMIT_MONTHLY = "0";
+          TIMELINE_LIMIT_YEARLY = "0";
+        };
+      };
+
     # ── Fonts ────────────────────────────────────────────────────────
     fonts = {
       packages = with pkgs; [
@@ -82,7 +107,21 @@ in
       wl-clipboard
       grim
       slurp
-    ];
+    ] ++ lib.optional (cfg.snapper.enable && (config.fileSystems."/".fsType or "") == "btrfs")
+      # Snapshot, then rebuild — rollback material for system changes
+      # (theme changes don't need it; HM generations already roll back).
+      (pkgs.writeShellScriptBin "nixos-rebuild-snap" ''
+        if [ "$(id -u)" -ne 0 ]; then
+          echo "This script must be run as root (use sudo)" >&2
+          exit 1
+        fi
+        echo "Creating pre-rebuild snapshot..."
+        ${pkgs.snapper}/bin/snapper -c root create \
+          -d "Pre-rebuild $(date +'%Y-%m-%d %H:%M:%S')" \
+          --cleanup-algorithm number
+        echo "Rebuilding..."
+        nixos-rebuild switch --flake /etc/nixos#default "$@"
+      '');
 
     # ── Nix itself ───────────────────────────────────────────────────
     nix = {