Invite fingerprint setup on first run when a reader is present

Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that
invites anyone with a fingerprint sensor to enable it. Clicking launches
omarchy-setup-security-fingerprint in a floating terminal.

Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs
(device product descriptor plus a fingerprint-vendor allowlist), so it
works before fprintd/usbutils are installed and without nagging machines
that have no reader. The setup script reuses the same helper as an early
gate, bailing before installing any packages when no reader is found
(replacing the old post-install fprintd-list probe).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/omarchy-setup-security-fingerprint

@@ -6,18 +6,6 @@
 set -e
 
 
-check_fingerprint_hardware() {
-  # Get fingerprint devices for the user
-  devices=$(fprintd-list "$USER" 2>/dev/null)
-
-  # Exit if no devices found
-  if [[ -z $devices ]]; then
-    echo -e "\e[31m\nNo fingerprint sensor detected.\e[0m"
-    return 1
-  fi
-  return 0
-}
-
 setup_pam_config() {
   # Configure sudo
   if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
@@ -72,6 +60,12 @@ EOF
 
 echo -e "\e[32mSetting up fingerprint scanner for authentication.\n\e[0m"
 
+# Bail before installing anything if there's no reader to talk to.
+if ! omarchy-hw-fingerprint; then
+  echo -e "\e[31mNo fingerprint sensor detected.\e[0m"
+  exit 1
+fi
+
 # Install required packages
 echo "Installing required packages..."
 
@@ -86,10 +80,6 @@ fi
 
 omarchy-pkg-add libfprint-git fprintd usbutils
 
-if ! check_fingerprint_hardware; then
-  exit 1
-fi
-
 # Configure PAM
 setup_pam_config