feat(fingerprint): password OR fingerprint in parallel at one prompt

Bernardo promoted the PROPOSED item live: with fingerprint PAM on,
sudo/login should accept whichever factor comes first instead of
pam_fprintd's wait-for-the-reader-then-password. Stock PAM cannot
express parallel factors (linux-pam#301), so this packages
pam-fprint-grosshack v0.3.0 (pkgs/, pinned from GitLab — the
field-standard fprintd fork), source-reviewed before packaging: every
failure path (no reader, no prints, fprintd absent/hung, timeout,
password typed) returns PAM_AUTHINFO_UNAVAIL and falls through; a
typed password is only ferried via PAM_AUTHTOK to the stock
`auth sufficient pam_unix.so … try_first_pass` rule — the module never
validates passwords itself, so it cannot lock out password login.

New option nomarchy.hardware.fingerprint.parallel, default TRUE (the
better UX is what opting into fingerprint PAM buys; false = stock
sequential). Wiring swaps the modulePath of stock fprintd's rule slot
(mkForce) so the sufficient-before-pam_unix ordering is inherited, not
recomputed. README + downstream template rows added.

Verified: V2 — checks.hardware-toggles extended to three nodes, green:
parallel node asserts the grosshack auth line precedes pam_unix in
/etc/pam.d/sudo and that with NO reader a correct password still
passes sudo while a wrong one fails (the lockout-safety invariant);
seqpam node gets stock pam_fprintd and no grosshack; nopam gets
neither. flake check + option-docs + template-sot green.
V3 pending (HARDWARE-QUEUE, AMD dev box): the real type-or-touch race,
fprintd-stopped fallback, hyprlock/greeter after a fingerprint win.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/pam-fprint-grosshack/default.nix

@@ -0,0 +1,50 @@
+# pam_fprintd_grosshack.so — fprintd's PAM module forked to accept the
+# password OR a fingerprint at the same prompt (upstream calls itself a
+# "gross hack"; it is also the field-standard answer to this PAM gap —
+# stock PAM cannot express parallel factors, linux-pam#301).
+#
+# Source reviewed before packaging (2026-07-12, v0.3.0 = fprintd 1.94.2
+# base + ~60-line delta): every failure path — no reader, no enrolled
+# prints, fprintd absent, timeout, password typed — returns
+# PAM_AUTHINFO_UNAVAIL, i.e. the module FAILS and PAM falls through to
+# the password rule; a typed password is never validated here, only
+# ferried via PAM_AUTHTOK to pam_unix (try_first_pass). Accepted
+# quirks: installs a process-wide SIGUSR1 handler in the calling
+# process, pthread_cancels the prompt thread on fingerprint win, and
+# does not zeroize the prompt buffer. Consumed by
+# modules/nixos/hardware.nix (nomarchy.hardware.fingerprint.parallel).
+{ lib, stdenv, fetchFromGitLab, meson, ninja, pkg-config, gettext, python3
+, glib, libfprint, polkit, pam, systemd, dbus, libpam-wrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "pam-fprint-grosshack";
+  version = "0.3.0";
+
+  src = fetchFromGitLab {
+    owner = "mishakmak";
+    repo  = "pam-fprint-grosshack";
+    rev   = "v${version}";
+    hash  = "sha256-obczZbf/oH4xGaVvp3y3ZyDdYhZnxlCWvL0irgEYIi0=";
+  };
+
+  # Only the PAM module is built (the fork disables every other fprintd
+  # subdir), but the top-level meson still resolves the full fprintd
+  # dependency set — hence libfprint/polkit in buildInputs.
+  # pam_wrapper is only exercised by the (disabled) test suite, but the
+  # top-level meson marks it required whenever the pam option is on.
+  nativeBuildInputs = [ meson ninja pkg-config gettext python3 ];
+  buildInputs       = [ glib libfprint polkit pam systemd dbus libpam-wrapper ];
+
+  mesonFlags = [
+    "-Dpam_modules_dir=${placeholder "out"}/lib/security"
+    "-Dsystemd=false"
+    "-Dman=false"
+  ];
+
+  meta = {
+    description = "PAM module accepting password or fingerprint in parallel (fprintd fork)";
+    homepage    = "https://gitlab.com/mishakmak/pam-fprint-grosshack";
+    license     = lib.licenses.gpl2Plus;
+    platforms   = lib.platforms.linux;
+  };
+}