feat(menu): #55 System › Fingerprint enroll/list/PAM

Self-gated System › Fingerprint when fprintd is on PATH: enroll, list,
verify, delete-all (terminal), and Use for login writing
settings.fingerprint.pam (hardware.nix default from theme-state). Close #55.

Verified: V1 (HM menu rebuild). V3 pending: real-reader enroll (HARDWARE-QUEUE).

modules/nixos/hardware.nix

@@ -15,6 +15,13 @@
 
 let
   cfg = config.nomarchy.hardware;
+  # Fingerprint PAM can follow theme-state.json (menu toggle → next
+  # sys-rebuild), same bridge as autoTimezone (BACKLOG #55).
+  hwState =
+    if config.nomarchy.system.stateFile != null
+    then builtins.fromJSON (builtins.readFile config.nomarchy.system.stateFile)
+    else { };
+  pamFromState = (hwState.settings or { }).fingerprint.pam or false;
 in
 {
   options.nomarchy.hardware = {
@@ -92,9 +99,18 @@ in
         a fingerprint reader via fprintd (the installer turns this on when it
         detects a known reader). Enroll with `fprintd-enroll`'';
 
-      pam = lib.mkEnableOption ''
-        using the fingerprint for login and sudo (PAM). Opt-in — password-only
-        stays the default for the cautious; enroll a finger first'';
+      pam = lib.mkOption {
+        type = lib.types.bool;
+        default = pamFromState;
+        defaultText = lib.literalExpression
+          "(settings.fingerprint.pam from theme-state.json) or false";
+        description = ''
+          Use the fingerprint for login and sudo (PAM). Opt-in — password-only
+          stays the default for the cautious; enroll a finger first. Defaults
+          from theme-state.json `settings.fingerprint.pam` (System › Fingerprint
+          menu) when set; otherwise false.
+        '';
+      };
     };
 
     npu.enable = lib.mkEnableOption ''