Add YubiKey U2F login/sudo auth; disable unused features by default

pam_u2f is set up as a sufficient factor ahead of password for sudo and
login (which greetd/tuigreet substacks), so touching the key logs in
without typing a password while leaving password as fallback.
Fingerprint was investigated too but lauretta's reader is an unsupported
match-on-chip sensor, documented in the feature instead of wired up.

Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default
since they're unused.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nixos/configuration.nix

@@ -21,6 +21,7 @@
     suiteModules.nixos.binfmt
     suiteModules.nixos.attic
     suiteModules.nixos.printing
+    suiteModules.nixos.hardware-auth
   ];
 
   boot.loader.grub = {
@@ -95,6 +96,7 @@
   azos.suites.exwm.enable = true;
   azos.attic.enable = true;
   azos.printing.enable = true;
+  azos.hardware-auth.enable = true;
 
   home-manager = {
     extraSpecialArgs = {inherit inputs outputs suiteModules pkgs;};