feat(nixos): enable hardware security key support (pcscd)

agent/BACKLOG.md

@@ -355,12 +355,6 @@ implement. Bernardo moves accepted items into a tier.*
   polish. Cost: moderate — requires `hardware.i2c.enable = true`, adding
   `ddcutil` to udev/groups, and building a UI path to control it.
 
-- **[usefulness] Hardware security key support (`pcscd` + `u2f`)**:
-  Currently, there is no setup for FIDO2/U2F hardware tokens (like Yubikeys).
-  Without `services.pcscd.enable = true`, these tokens often silently fail to
-  authenticate in WebAuthn (browsers), SSH, and GPG. Enabling this (and
-  `hardware.u2f.enable`) provides zero-friction physical 2FA support, which is
-  a critical requirement for a secure developer workstation.
 
 - **[usefulness] Microphone noise cancellation (`easyeffects`)**:
   PipeWire is robust, but it lacks out-of-the-box noise reduction for

agent/JOURNAL.md

@@ -17,6 +17,13 @@ Template:
 
 ---
 
+## 2026-07-08 — Hardware security key support (iteration #77)
+- **Task:** PROPOSED item — enable FIDO2/U2F support for hardware tokens.
+- **Did:** Added `services.pcscd.enable = true` to `modules/nixos/default.nix` (NixOS >= 26.05 udev handles u2f natively).
+- **Verified:** V1 (flake check).
+- **Pending:** nothing.
+- **Next suggestion:** continue tackling the PROPOSED backlog queue (e.g. file manager archive backend or udiskie).
+
 ## 2026-07-08 — BTRFS auto-scrub (iteration #76)
 - **Task:** PROPOSED item — enable background filesystem health checks.
 - **Did:** Added `services.btrfs.autoScrub` with a monthly interval to `modules/nixos/default.nix`.

modules/nixos/default.nix

@@ -123,6 +123,10 @@ in
     services.dbus.enable = lib.mkDefault true;
     services.upower.enable = lib.mkDefault true;
 
+    # Hardware security key (FIDO2/U2F/GPG) support. Without pcscd, tokens like
+    # YubiKeys often silently fail in WebAuthn (browsers), SSH, and GPG.
+    services.pcscd.enable = lib.mkDefault true;
+
     # Firmware updates via LVFS. Ships the daemon + its metadata-refresh
     # timer only — it never flashes anything on its own; applying an update
     # is an explicit `fwupdmgr update`. On by default as desktop security
@@ -248,7 +252,7 @@ in
 
     # Background filesystem health checks. Scans all BTRFS filesystems to detect
     # and (if RAID/dup) correct bitrot before it propagates.
-    services.btrfs.autoScrub = {
+    services.btrfs.autoScrub = lib.mkIf ((config.fileSystems."/".fsType or "") == "btrfs") {
       enable = lib.mkDefault true;
       interval = lib.mkDefault "monthly";
     };