feat(menu): #55 System › Fingerprint enroll/list/PAM

Self-gated System › Fingerprint when fprintd is on PATH: enroll, list,
verify, delete-all (terminal), and Use for login writing
settings.fingerprint.pam (hardware.nix default from theme-state). Close #55.

Verified: V1 (HM menu rebuild). V3 pending: real-reader enroll (HARDWARE-QUEUE).

agent/HARDWARE-QUEUE.md

@@ -8,6 +8,11 @@ the failure as a NOW bug in BACKLOG.md. Machines: the **AMD dev box**
 QA machine), the **T14s** (webcam case).
 
 ## Any machine (dev box is fine)
+- [ ] **#55 fingerprint enroll on real reader** — with
+      `nomarchy.hardware.fingerprint.enable` and a physical reader: System ›
+      Fingerprint › Enroll a finger; List shows it; Verify succeeds; optional
+      Use for login (on) → `sys-rebuild` → login/sudo accept fingerprint.
+      Menu surface is V1/V2 without a reader (self-gate + dry paths).
 - [ ] **#60 non-BAT* battery name (if available)** — on a machine whose
       system battery is **not** named `BAT*` (e.g. `CMB0`): confirm
       charge-limit oneshot writes the threshold, System › Battery limit