Invite fingerprint setup on first run when a reader is present

Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that
invites anyone with a fingerprint sensor to enable it. Clicking launches
omarchy-setup-security-fingerprint in a floating terminal.

Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs
(device product descriptor plus a fingerprint-vendor allowlist), so it
works before fprintd/usbutils are installed and without nagging machines
that have no reader. The setup script reuses the same helper as an early
gate, bailing before installing any packages when no reader is found
(replacing the old post-install fprintd-list probe).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

install/user/first-run/fingerprint.sh

@@ -0,0 +1,9 @@
+(
+  # Only invite when there's a reader to use and it isn't set up yet (the lock
+  # PAM file is the last thing the setup writes on success).
+  if omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
+    if [[ -n $(omarchy-notification-send -u critical -g 󰈷 "Setup Fingerprint" "Click to unlock login, sudo, and the lock screen with your fingerprint." -a) ]]; then
+      omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint
+    fi
+  fi
+) >/dev/null 2>&1 &