feat(hints): #73 fingerprint + doctor MOTD/first-boot tips

#43 shipped Firmware MOTD + control-center --first-boot tip. Residual:
- MOTD always lists nomarchy-doctor; Fingerprint line only when
  nomarchy.hardware.fingerprint.enable (no nag without a reader).
- first-boot tips self-gate on fprintd-list / nomarchy-doctor (same
  gum style as Firmware). No dismiss state file — first-boot is once.

V0 flake check --no-build + bash -n; V1 build control-center + eval
MOTD with/without fingerprint.enable. V3 enroll stays hardware-queue.

docs/HARDWARE.md

@@ -120,9 +120,10 @@ Disable on VMs/headless: `services.fwupd.enable = false;` in `system.nix`.
 
 | Present | Missing |
 |---------|---------|
-| Daemon + package | First-boot / MOTD hint |
-| README one-liner | Doctor check (“updates available”) |
-| **System ▸ Firmware menu** (`nomarchy-menu firmware`) | Waybar / updates panel integration |
+| Daemon + package | Doctor check (“updates available”) |
+| README one-liner | Waybar / updates panel integration |
+| **System ▸ Firmware menu** (`nomarchy-menu firmware`) | |
+| MOTD + first-boot tip (#43) | |
 
 **System ▸ Firmware** (shipped): a self-gated System-submenu row (present
 whenever `fwupdmgr` is on PATH, i.e. `services.fwupd.enable`, default-on)
@@ -131,8 +132,13 @@ confirm → `fwupdmgr update`. It never auto-flashes — `fwupdmgr update`
 confirms each device and prompts for the reboot a capsule needs; pillar 1
 (rock-stable) forbids silent BIOS writes.
 
-**Still queued:** a post-install / MOTD one-liner when `fwupd` is active,
-a Doctor “updates available” check, and Waybar/updates-panel integration.
+**Hints (#43 / #73):** MOTD cheat-sheet line + `nomarchy-control-center
+--first-boot` tip when `fwupdmgr` is on PATH. Fingerprint / doctor tips
+follow the same pattern (fingerprint MOTD only when
+`nomarchy.hardware.fingerprint.enable`).
+
+**Still queued:** a Doctor “updates available” check, and
+Waybar/updates-panel integration.
 
 ### Thunderbolt
 
@@ -170,6 +176,10 @@ on PATH) — Enroll / List / Verify / Delete all, plus **Use for login**
 which writes `settings.fingerprint.pam` and applies on the next
 `sys-rebuild` (option default follows theme-state.json).
 
+**Hints (#73):** MOTD line when `fingerprint.enable` is on; first-boot
+tip when `fprintd-list` is on PATH (`SUPER+M → System › Fingerprint` /
+`fprintd-enroll`). No permanent nag without a reader.
+
 ```sh
 # CLI still works:
 fprintd-enroll

modules/nixos/default.nix

@@ -47,8 +47,10 @@ in
 
     # MOTD on TTY/SSH login (the desktop auto-logs into Hyprland, so this
     # is mostly seen over SSH or on a bare console). Branded, and doubles
-    # as a cheat sheet for the distro's own helpers.
-    users.motd = lib.mkDefault ''
+    # as a cheat sheet for the distro's own helpers. Fingerprint line only
+    # when fprintd is enabled (no permanent nag on machines without a
+    # reader); doctor is always on PATH via systemPackages.
+    users.motd = lib.mkDefault (''
 
         ${distroName} — a NixOS desktop, themed from one JSON.
 
@@ -56,9 +58,12 @@ in
         sys-rebuild                         rebuild the system, no input update
         home-update                         apply home/theme changes (no sudo)
         nomarchy-theme-sync apply <theme>   switch the whole palette
+        nomarchy-doctor                     read-only health check
         SUPER+?                             keybindings cheatsheet
         SUPER+M → System › Firmware         check LVFS firmware updates (fwupd)
-    '';
+    '' + lib.optionalString config.nomarchy.hardware.fingerprint.enable ''
+        SUPER+M → System › Fingerprint      enroll a finger (fprintd)
+    '');
 
     # Unfree allowed distro-wide: pragmatic-desktop territory (vendor
     # GPU/wifi drivers, firmware, fonts, …). The custom nixpkgs-config

pkgs/nomarchy-control-center/nomarchy-control-center.sh

@@ -39,10 +39,21 @@ function first_boot() {
         fi
     fi
     
+    # Post-install hardware/day-2 tips (#43 Firmware; #73 fingerprint +
+    # doctor). Self-gated on the same CLI presence the System menu uses;
+    # first-boot is once, so no dismiss state file is needed.
     if command -v fwupdmgr >/dev/null 2>&1; then
         gum style --foreground 245 \
             "Tip: SUPER+M → System › Firmware checks LVFS updates (never auto-flashes)."
     fi
+    if command -v fprintd-list >/dev/null 2>&1; then
+        gum style --foreground 245 \
+            "Tip: SUPER+M → System › Fingerprint to enroll a finger (or fprintd-enroll)."
+    fi
+    if command -v nomarchy-doctor >/dev/null 2>&1; then
+        gum style --foreground 245 \
+            "Tip: run nomarchy-doctor (or SUPER+M → System › Doctor) for a read-only health check."
+    fi
 
     gum style --foreground 212 "First boot configuration complete!"
     echo "You can always change these later in the Control Center."