feat(nixos): enable hardware security key support (pcscd)

modules/nixos/default.nix

@@ -123,6 +123,10 @@ in
     services.dbus.enable = lib.mkDefault true;
     services.upower.enable = lib.mkDefault true;
 
+    # Hardware security key (FIDO2/U2F/GPG) support. Without pcscd, tokens like
+    # YubiKeys often silently fail in WebAuthn (browsers), SSH, and GPG.
+    services.pcscd.enable = lib.mkDefault true;
+
     # Firmware updates via LVFS. Ships the daemon + its metadata-refresh
     # timer only — it never flashes anything on its own; applying an update
     # is an explicit `fwupdmgr update`. On by default as desktop security
@@ -248,7 +252,7 @@ in
 
     # Background filesystem health checks. Scans all BTRFS filesystems to detect
     # and (if RAID/dup) correct bitrot before it propagates.
-    services.btrfs.autoScrub = {
+    services.btrfs.autoScrub = lib.mkIf ((config.fileSystems."/".fsType or "") == "btrfs") {
       enable = lib.mkDefault true;
       interval = lib.mkDefault "monthly";
     };