feat(install): LUKS by default → auto-login, snapper snapshots, hibernation swapfile

- LUKS2 is the installer default; in exchange the generated config sets
  the new nomarchy.system.greeter.autoLogin (greetd initial_session) —
  the disk passphrase already gates the machine.
- @snapshots subvolume + nomarchy.system.snapper.enable: hourly/daily
  timeline snapshots of / and the nixos-rebuild-snap helper, ported from
  the previous iteration (3bdfc35), guarded to no-op on non-BTRFS roots.
- @swap subvolume with a swapfile sized to RAM by default (disko
  mkswapfile handles NOCOW); the installer computes the resume offset
  and wires boot.resumeDevice + resume_offset for hibernation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/nomarchy-install/disko-config.nix

@@ -5,6 +5,7 @@
 #   disko --mode destroy,format,mount \
 #         --argstr mainDrive /dev/nvme0n1 \
 #         --arg    withLuks true \
+#         --argstr swapSize 16G \
 #         disko-config.nix
 #
 # Ported from the previous iteration's golden-path config (multi-disk
@@ -14,6 +15,7 @@
 # proved fragile twice before.
 { mainDrive
 , withLuks ? true
+, swapSize ? "0"   # "0" = no swap; otherwise e.g. "16G" (sized for hibernation)
 , ...
 }:
 
@@ -28,7 +30,16 @@ let
       "@home" = { mountpoint = "/home"; mountOptions = btrfsMountOptions; };
       "@nix" = { mountpoint = "/nix"; mountOptions = btrfsMountOptions; };
       "@log" = { mountpoint = "/var/log"; mountOptions = btrfsMountOptions; };
-    };
+      # snapper timeline snapshots (nomarchy.system.snapper.enable)
+      "@snapshots" = { mountpoint = "/.snapshots"; mountOptions = btrfsMountOptions; };
+    } // (if swapSize == "0" then { } else {
+      # Hibernation-ready swapfile on its own subvolume; disko's
+      # mkswapfile handles the BTRFS NOCOW requirements.
+      "@swap" = {
+        mountpoint = "/swap";
+        swap.swapfile.size = swapSize;
+      };
+    });
   };
 in
 {