feat(idle): a real lock bind, and a lock screen that speaks in sentences

Two nits from the post-reboot hardware pass.

Super+Escape never locked anything — there was no lock bind at all, only
the power menu's Lock row and the idle timeout. (Escape is unusable here
anyway; keybinds.nix has said so since the power menu moved to Super+X,
and an unswallowed Escape just prints its sequence into the terminal.)
Lock now lives at Super+Ctrl+L: the one row in that family that is not a
menu module, because bare Super+L collides with common app binds. It
dispatches loginctl lock-session, the same path the power menu's Lock row
takes, so logind marks the session locked and hypridle's lock_cmd remains
the single place that decides what a lock looks like.

The lock prompt read as clipped fragments ("password… or scan finger" /
"scanning finger…") next to a 64px clock. Both messages are sentences
now, and the input field's placeholder is sentence-cased to match — the
two can share the screen, so they cannot read as two different voices.

V1 + V3 pending: nix flake check --no-build passes; the built home
generation carries `bind=$mod CTRL, L, exec, loginctl lock-session`, the
new ready/present messages (built with idle.fingerprint forced on, since
the in-repo config leaves it off), and a "SUPER + CTRL + L  Lock screen"
row the cheatsheet generated on its own from the shared list. The reader
itself only exists on hardware.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/OMARCHY.md

@@ -67,6 +67,7 @@ live cheatsheet — you never have to memorize this table.
 | `SUPER+SHIFT+T` | Next wallpaper |
 | `SUPER+E` | File manager (yazi) |
 | `SUPER+X` | Power menu (lock / suspend / hibernate / reboot …) |
+| `SUPER+CTRL+L` | Lock screen |
 | `SUPER+?` | Keybindings cheatsheet |
 | `Print` | Screenshot region → clipboard |
 | `SUPER+CTRL+<key>` | Jump straight to a menu module (clipboard `V`, calc `C`, emoji `E`, capture `S`, …) |

modules/home/idle.nix

@@ -43,7 +43,9 @@ in
           check_color = rgb c.warn;
           fail_color = rgb c.bad;
           rounding = t.ui.rounding;
-          placeholder_text = "<i>password…</i>";
+          # Sentence case, matching the $FPRINTPROMPT label below: both can be
+          # on screen at once, so they must not read as two different voices.
+          placeholder_text = "<i>Password…</i>";
         }];
 
         # The lock screen is deliberately just the clock: the input field
@@ -54,8 +56,8 @@ in
         # started typing.  It needs a surface that is visible at rest, and a
         # label is the one that keeps the clock-only look.  (Confirmed on
         # hardware 2026-07-14: labels do expand $FPRINTPROMPT, so the line is
-        # live — "password… or scan finger", then "scanning finger…" on touch —
-        # and not static text.)
+        # live — the ready message, then the present message on touch — and
+        # not static text.  Both live in auth.fingerprint below.)
         label = [{
           monitor = "";
           text = "$TIME";
@@ -86,11 +88,10 @@ in
         # D-Bus, and `nomarchy.hardware.fingerprint.pam` does not reach it —
         # which is why finger-unlock at the lock screen did nothing at all
         # until this option existed, while sudo took a finger happily.
-        # The wording mirrors sudo's "Enter Password or Place finger" prompt.
         auth.fingerprint = {
           enabled = true;
-          ready_message = "password… or scan finger";
-          present_message = "scanning finger…";
+          ready_message = "Enter password or scan your finger";
+          present_message = "Scanning your finger…";
         };
       };
     };

modules/home/keybinds.nix

@@ -57,6 +57,13 @@
     # I as in "settings" muscle memory (Super+I elsewhere); T for Tools.
     { mods = "$mod CTRL";   key = "I";      action = "exec, nomarchy-menu system";    desc = "System menu"; }
     { mods = "$mod CTRL";   key = "T";      action = "exec, nomarchy-menu tools";     desc = "Tools menu"; }
+    # The one SUPER+CTRL row that is not a menu module: lock earns the
+    # family slot because bare SUPER+L is a common app bind and Escape is
+    # unusable (see the power-menu note above). Same dispatcher the power
+    # menu's Lock row uses (rofi.nix) — logind, not `hyprlock` directly, so
+    # the session is marked locked and hypridle's lock_cmd stays the one
+    # place that decides how a lock actually looks.
+    { mods = "$mod CTRL";   key = "L";      action = "exec, loginctl lock-session";   desc = "Lock screen"; }
     { mods = "$mod SHIFT";  key = "C";      action = "exec, hyprpicker -a";           desc = "Color picker (→ clipboard)"; }
 
     # Focus — SUPER + arrow keys.