feat(idle): no double-unlock after an encrypted hibernate resume

hypridle locks hyprlock before every sleep -- right for suspend, but
redundant for hibernate: the LUKS passphrase entered at boot already gates
the resume, so the user typed a password twice. Add a nomarchy-hibernate-
unlock systemd unit (WantedBy hibernate.target, After systemd-hibernate.service
=> runs post-resume) that dismisses hyprlock, gated on the disk being LUKS-
encrypted. Suspend (and the RAM-resume phase of suspend-then-hibernate) keep
locking -- they have no passphrase gate; an unencrypted hibernate keeps its
lock too. idle.nix gains a pointer comment; roadmap item marked done.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home/idle.nix

@@ -54,6 +54,10 @@ in
       settings = {
         general = {
           lock_cmd = "pidof hyprlock || hyprlock";
+          # Locks before every sleep. For suspend that's exactly right; on an
+          # encrypted hibernate the LUKS resume already gates the machine, so
+          # the system side dismisses this lock post-resume to avoid a double
+          # unlock — see nomarchy-hibernate-unlock in modules/nixos/default.nix.
           before_sleep_cmd = "loginctl lock-session";
           after_sleep_cmd = "hyprctl dispatch dpms on";
         };