feat(install): LUKS by default → auto-login, snapper snapshots, hibernation swapfile

- LUKS2 is the installer default; in exchange the generated config sets
  the new nomarchy.system.greeter.autoLogin (greetd initial_session) —
  the disk passphrase already gates the machine.
- @snapshots subvolume + nomarchy.system.snapper.enable: hourly/daily
  timeline snapshots of / and the nixos-rebuild-snap helper, ported from
  the previous iteration (3bdfc35), guarded to no-op on non-BTRFS roots.
- @swap subvolume with a swapfile sized to RAM by default (disko
  mkswapfile handles NOCOW); the installer computes the resume offset
  and wires boot.resumeDevice + resume_offset for hibernation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/options.nix

@@ -8,7 +8,26 @@
 {
   options.nomarchy.system = {
     greeter.enable = lib.mkEnableOption "the greetd/tuigreet login screen" // { default = true; };
+
+    greeter.autoLogin = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "ada";
+      description = ''
+        Log this user straight into Hyprland on boot (greetd
+        initial_session); logging out lands on the normal greeter.
+        The installer sets it on LUKS-encrypted machines — the disk
+        passphrase already gates access, a second prompt is ceremony.
+      '';
+    };
+
     audio.enable = lib.mkEnableOption "the Pipewire audio stack" // { default = true; };
     bluetooth.enable = lib.mkEnableOption "Bluetooth support with blueman" // { default = true; };
+
+    snapper.enable = lib.mkEnableOption ''
+      hourly/daily BTRFS timeline snapshots of / via snapper, plus the
+      `nixos-rebuild-snap` pre-rebuild-snapshot helper. No-op unless the
+      root filesystem is BTRFS with a /.snapshots subvolume (the installer
+      creates one)'';
   };
 }