feat(menu): #55 System › Fingerprint enroll/list/PAM

Self-gated System › Fingerprint when fprintd is on PATH: enroll, list,
verify, delete-all (terminal), and Use for login writing
settings.fingerprint.pam (hardware.nix default from theme-state). Close #55.

Verified: V1 (HM menu rebuild). V3 pending: real-reader enroll (HARDWARE-QUEUE).

docs/HARDWARE.md

@@ -163,27 +163,26 @@ nomarchy.hardware.fingerprint.enable = true;  # services.fprintd
 # nomarchy.hardware.fingerprint.pam = true;   # login + sudo (opt-in)
 ```
 
-### Enroll (CLI today)
+### Enroll (menu or CLI)
+
+**Shipped #55:** System › Fingerprint (self-gated when `fprintd-list` is
+on PATH) — Enroll / List / Verify / Delete all, plus **Use for login**
+which writes `settings.fingerprint.pam` and applies on the next
+`sys-rebuild` (option default follows theme-state.json).
 
 ```sh
-fprintd-enroll            # as your user
+# CLI still works:
+fprintd-enroll
 fprintd-list "$USER"
-# then, if you want login/sudo:
-# uncomment fingerprint.pam in system.nix → sys-rebuild
+# or: System › Fingerprint › Use for login (on) → sys-rebuild
 ```
 
 PAM stays opt-in on purpose: password-only remains the cautious default
-until a finger is enrolled.
+until a finger is enrolled. Full enroll on a real reader is V3/hardware.
 
-### Gaps
+### Doctor
 
-- No System menu “Fingerprint” row (enroll / list / delete).
-- No “use for login” toggle that writes state + rebuild note.
-- Doctor does not check reader presence or enroll status.
-
-**Product direction (queued):** when `fprintd` is active, a self-gated
-menu module for enroll/list; optional PAM toggle via state + rebuild
-hint (same pattern as Bluetooth in Control Center).
+`nomarchy-doctor` reports fprintd unit + enroll status when present.
 
 ## 6. NVIDIA (deep dive)