feat: regreet and swaylock from nixpkgs, autologin after LUKS

greetd.nix configures services.displayManager.regreet and keeps niri as
the greeter compositor, so niri-greeter.kdl stays the shared file that
carries the German keyboard layout. The moongreet input, its package and
pkgs/moongreet.nix are gone.

extraCss goes through builtins.readFile: the module only recognises a
direct /nix/store child as a path, so passing the file path as a string
wrote the path itself into /etc/greetd/regreet.css.

desktop.nix installs swaylock, seeds ~/.config/swaylock/config with the
wallpaper rewritten to the store path, and now owns the moonlock PAM
stack. The Colloid overrides moved to flake.nix so the greeter and the
desktop share one derivation.

initial_session is set per host because the accounts differ. greetd's
restart option flips itself off, verified.

flake.lock still pins moonarch at the pushed revision; it needs
`nix flake update moonarch` once the moonarch commit is pushed.

hosts/testvm/default.nix

@@ -39,6 +39,18 @@
     shell = pkgs.zsh;
   };
 
+  # LUKS already asked for a passphrase at boot, so the greeter would only ask
+  # for a second one. initial_session runs once per boot — the greeter comes
+  # back on logout, which is also where a session gets switched. greetd's
+  # restart option flips itself off when this is set.
+  #
+  # The account still needs a password: swaylock authenticates through
+  # pam_unix, and without a /etc/shadow entry the screen cannot be unlocked.
+  services.greetd.settings.initial_session = {
+    command = "${pkgs.niri}/bin/niri-session";
+    user = "kresdo";
+  };
+
   # Development access from the host via the QEMU port forward on 127.0.0.1:2222.
   services.openssh.enable = true;