Add YubiKey U2F login/sudo auth; disable unused features by default

pam_u2f is set up as a sufficient factor ahead of password for sudo and
login (which greetd/tuigreet substacks), so touching the key logs in
without typing a password while leaving password as fallback.
Fingerprint was investigated too but lauretta's reader is an unsupported
match-on-chip sensor, documented in the feature instead of wired up.

Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default
since they're unused.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

features/kubernetes/default.nix

@@ -6,7 +6,7 @@
     ...
   }: {
     options.azos.kubectl.enable = lib.mkOption {
-      default = true;
+      default = false;
       type = lib.types.bool;
     };
     config = lib.mkIf config.azos.kubectl.enable {