fix(live): allow empty-password hyprlock unlock on live ISO

pam_unix rejects empty passwords by default, so if hypridle locked the
live session there was nothing the user could type to unlock it. Set
allowNullPassword on the hyprlock PAM service so a bare Enter dismisses
the locker, matching the empty live account passwords. Scoped to the
live host so installed systems still reject empty unlocks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/nomarchy-live.nix

@@ -81,6 +81,13 @@
   # Allow passwordless sudo for the live user
   security.sudo.wheelNeedsPassword = false;
 
+  # The live accounts have empty passwords, but pam_unix rejects an empty
+  # password by default — which leaves hyprlock unsolvable if the idle
+  # timer locks the session (nothing you can type unlocks it). Allow null
+  # passwords for the locker so it can be dismissed with a bare Enter.
+  # Live-ISO only: installed systems must never accept empty unlocks.
+  security.pam.services.hyprlock.allowNullPassword = true;
+
   # Override the upstream installer helpLine (says "NixOS", points nowhere
   # useful for us). Shown on every TTY before login and again as the MOTD.
   services.getty.helpLine = lib.mkForce ''