docs: roadmap item for SSH/GPG agent + graphical pinentry

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -350,6 +350,13 @@ close · `SUPER+1..9` workspaces · `Print` region screenshot.
   also locks hyprlock, so the user types a password twice. Lock only on
   suspend (not hibernate), or skip the hyprlock prompt when resuming from
   a LUKS-encrypted hibernate — see `modules/home/idle.nix`.
+- **Key agents & pinentry:** no SSH/GPG agent ships yet, so signing/auth
+  prompts have nowhere to go. Wire up an agent + a Wayland-native graphical
+  pinentry: `services.ssh-agent` (or gpg-agent's `enableSshSupport`),
+  `programs.gnupg.agent` with `pinentry-gnome3`/`pinentry-qt`, `SSH_AUTH_SOCK`
+  exported, and the pinentry styled from the palette where it can be. Decide
+  one-agent (gpg-agent fronting SSH) vs. two, and confirm it cooperates with
+  hyprlock/hypridle on unlock.
 
 ## Known issues & follow-ups
 - **Yazi TOML parse error on startup:** `[[plugin.prepend_fetchers]]` is