Show fingerprint on lock screen and polkit, gated by lid state

Bring the fingerprint affordance to the Quickshell lock screen and polkit
dialog, matching what hyprlock did on master.

Lock screen: render the md-fingerprint glyph inside the password field's
right edge when a sensor is enrolled, reserving space so long passwords
never run under it.

Polkit dialog: show one method at a time. When a sensor is enrolled and
the reader is reachable, the dialog is just the centered fingerprint icon
(square card); the moment PAM asks for a password it switches to the
password field. Detects pam_fprintd anywhere in the auth stack now that a
gate can precede it.

Lid awareness: a closed lid means the reader is unreachable, so both
surfaces fall back to the password. polkit gets a pam_exec clamshell gate
(auth [success=1 default=ignore] before pam_fprintd) so a shut lid drops
straight to the password prompt instead of blocking on the reader for the
pam_fprintd timeout; the lock screen hides the icon and skips scanning.

The gate points at the fixed /usr/bin path the package always provides so
it survives switching between package installs and dev-link. A migration
adds the gate for existing fingerprint setups.

New helper omarchy-hw-laptop-closed (pure lid state); omarchy-hw-clamshell
now composes it with the external-monitor check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

migrations/1784818437.sh

@@ -0,0 +1,21 @@
+echo "Gate polkit fingerprint auth behind the lid state (password when the lid is shut)"
+
+# Existing fingerprint setups have pam_fprintd first in /etc/pam.d/polkit-1 but
+# no lid gate, so a closed-lid pkexec would block on the unreachable reader for
+# the full pam_fprintd timeout before offering the password. Insert a pam_exec
+# gate before pam_fprintd that skips fingerprint while the lid is closed. New
+# setups already get this from omarchy-setup-security-fingerprint.
+#
+# The gate points at the fixed /usr/bin path the omarchy package always
+# provides, so it keeps working across package installs and dev-link (which
+# overlays $OMARCHY_PATH but leaves /usr/bin untouched). pam_exec needs a
+# literal absolute path — it does not expand env vars.
+
+polkit_pam="/etc/pam.d/polkit-1"
+gate="auth      [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed"
+
+if [[ -f $polkit_pam ]] &&
+  grep -q 'pam_fprintd\.so' "$polkit_pam" &&
+  ! grep -q 'omarchy-hw-laptop-closed' "$polkit_pam"; then
+  sudo sed -i "/pam_fprintd\.so/i $gate" "$polkit_pam"
+fi