Add YubiKey U2F login/sudo auth; disable unused features by default

pam_u2f is set up as a sufficient factor ahead of password for sudo and
login (which greetd/tuigreet substacks), so touching the key logs in
without typing a password while leaving password as fallback.
Fingerprint was investigated too but lauretta's reader is an unsupported
match-on-chip sensor, documented in the feature instead of wired up.

Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default
since they're unused.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

features/hardware-auth/default.nix

@@ -0,0 +1,52 @@
+{...}: {
+  config.flake.modules.nixos.hardware-auth = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }: {
+    options.azos.hardware-auth.enable = lib.mkOption {
+      default = false;
+      example = true;
+      type = lib.types.bool;
+      description = ''
+        Enables YubiKey (U2F/FIDO2) as a "sufficient" PAM factor ahead of
+        the password, for both sudo and login (which greetd/tuigreet
+        substacks) -- touch the key to auth, or just type your password as
+        normal if it's not plugged in.
+
+        After enabling and rebuilding, enroll each key on the new machine
+        (per-user, not machine-wide state, so this must be redone per
+        machine):
+
+          mkdir -p ~/.config/Yubico
+          pamu2fcfg > ~/.config/Yubico/u2f_keys
+
+        To add a second/backup key without overwriting the first:
+
+          pamu2fcfg -n >> ~/.config/Yubico/u2f_keys
+
+        Test with `sudo true` (touching the key) before trusting it on the
+        greeter -- a login lockout is harder to recover from than a failed
+        sudo in an already-open session.
+      '';
+    };
+
+    config = lib.mkIf config.azos.hardware-auth.enable {
+      # Default NixOS PAM rule ordering already tries u2f before pam_unix
+      # (password), both "sufficient" -- so YubiKey touch wins first,
+      # password always remains as fallback.
+      #
+      # Fingerprint (fprintd) is deliberately not wired up here: lauretta's
+      # reader is a Synaptics Metallica MIS (06cb:009a), a match-on-chip
+      # sensor unsupported by upstream libfprint. The only known fix is an
+      # unofficial python-validity + open-fprintd stack, not packaged in
+      # nixpkgs and fragile enough (suspend/resume, PAM lockout risk) to not
+      # be worth it for now.
+      security.pam.u2f = {
+        enable = true;
+        settings.cue = true;
+      };
+    };
+  };
+}

features/kubernetes/default.nix

@@ -6,7 +6,7 @@
     ...
   }: {
     options.azos.kubectl.enable = lib.mkOption {
-      default = true;
+      default = false;
       type = lib.types.bool;
     };
     config = lib.mkIf config.azos.kubectl.enable {

features/qutebrowser/default.nix

@@ -5,7 +5,7 @@
     ...
   }: {
     options.azos.qutebrowser-config.enable = lib.mkOption {
-      default = true;
+      default = false;
       type = lib.types.bool;
     };
     config = lib.mkIf config.azos.qutebrowser-config.enable {

features/snx-rs/default.nix

@@ -9,7 +9,7 @@
   in {
     options.azos.snx-rs = {
       enable = lib.mkOption {
-        default = true;
+        default = false;
         type = lib.types.bool;
       };
       server = lib.mkOption {

nixos/configuration.nix

@@ -21,6 +21,7 @@
     suiteModules.nixos.binfmt
     suiteModules.nixos.attic
     suiteModules.nixos.printing
+    suiteModules.nixos.hardware-auth
   ];
 
   boot.loader.grub = {
@@ -95,6 +96,7 @@
   azos.suites.exwm.enable = true;
   azos.attic.enable = true;
   azos.printing.enable = true;
+  azos.hardware-auth.enable = true;
 
   home-manager = {
     extraSpecialArgs = {inherit inputs outputs suiteModules pkgs;};