feat(Auth): Unify shared PAM sync across greeter & lockscreen

- Add a neutral `dms auth sync` command and reuse the shared auth flow from:
- Settings auth toggle auto-apply
- `dms greeter sync`
- `dms greeter install`
- greeter auth cleanup paths

- Rework lockscreen PAM so DMS builds /etc/pam.d/dankshell from the system login stack, but removes fingerprint and U2F from that password path. Keep /etc/pam.d/dankshell-u2f separate.

- Preserve custom PAM files in place to avoid adding duplicate greeter auth when the distro already provides it, and keep NixOS on the non-writing path.

quickshell/Modules/Lock/LockScreenContent.qml

@@ -52,6 +52,12 @@ Item {
             return I18n.tr("Touch your security key...");
         if (pam.lockMessage && pam.lockMessage.length > 0)
             return pam.lockMessage;
+        if (root.pamState === "error")
+            return I18n.tr("Authentication error - try again");
+        if (root.pamState === "max")
+            return I18n.tr("Too many attempts - locked out");
+        if (root.pamState === "fail")
+            return I18n.tr("Incorrect password - try again");
         if (pam.fprintState === "error") {
             const detail = (pam.fprint.message || "").trim();
             return detail.length > 0 ? I18n.tr("Fingerprint error: %1").arg(detail) : I18n.tr("Fingerprint error");
@@ -60,12 +66,6 @@ Item {
             return I18n.tr("Maximum fingerprint attempts reached. Please use password.");
         if (pam.fprintState === "fail")
             return I18n.tr("Fingerprint not recognized (%1/%2). Please try again or use password.").arg(pam.fprint.tries).arg(SettingsData.maxFprintTries);
-        if (root.pamState === "error")
-            return I18n.tr("Authentication error - try again");
-        if (root.pamState === "max")
-            return I18n.tr("Too many attempts - locked out");
-        if (root.pamState === "fail")
-            return I18n.tr("Incorrect password - try again");
         return "";
     }
 

quickshell/Modules/Lock/Pam.qml

@@ -91,9 +91,9 @@ Scope {
     }
 
     FileView {
-        id: loginConfigWatcher
+        id: nixosMarker
 
-        path: "/etc/pam.d/login"
+        path: "/etc/NIXOS"
         printErrors: false
     }
 
@@ -108,7 +108,7 @@ Scope {
         id: passwd
 
         config: dankshellConfigWatcher.loaded ? "dankshell" : "login"
-        configDirectory: (dankshellConfigWatcher.loaded || loginConfigWatcher.loaded) ? "/etc/pam.d" : Quickshell.shellDir + "/assets/pam"
+        configDirectory: (dankshellConfigWatcher.loaded || nixosMarker.loaded) ? "/etc/pam.d" : Quickshell.shellDir + "/assets/pam"
 
         onMessageChanged: {
             if (message.startsWith("The account is locked")) {