feat: desktop host with /home on a second disk

Adds hosts/desktop: 512G system disk, 1T disk for /home, each in its own
LUKS container. modules/disk.nix gains moonarch.disk.home, which moves the
/home subvolume to the second disk and drops it from the first.

New modules/user.nix declares moonarch.user without a default, so the login
name exists once per host instead of once per reference. Both hosts set an
initialPassword: swaylock authenticates through pam_unix and cannot unlock a
screen for an account without one.

hosts/testvm/default.nix

@@ -1,7 +1,7 @@
 # ABOUTME: Host configuration for the QEMU/KVM test VM.
 # ABOUTME: Launcher script lives outside this repo at ~/VMs/moonix-vm.sh.
 
-{ pkgs, modulesPath, ... }:
+{ config, pkgs, modulesPath, ... }:
 
 {
   # virtio_blk and virtio_pci are not in boot.initrd.availableKernelModules by
@@ -32,23 +32,25 @@
   i18n.defaultLocale = "de_DE.UTF-8";
   console.keyMap = "de";
 
-  users.users.kresdo = {
+  moonarch.user = "moon";
+
+  users.users.${config.moonarch.user} = {
     isNormalUser = true;
-    description = "Dominik Kressler";
     extraGroups = [ "networkmanager" "wheel" "video" "input" ];
     shell = pkgs.zsh;
+    # Throwaway password for a throwaway guest. `mutableUsers` is at its
+    # default, so this applies when the account is created and `passwd`
+    # overrides it afterwards.
+    initialPassword = "moonarch";
   };
 
   # LUKS already asked for a passphrase at boot, so the greeter would only ask
   # for a second one. initial_session runs once per boot — the greeter comes
   # back on logout, which is also where a session gets switched. greetd's
   # restart option flips itself off when this is set.
-  #
-  # The account still needs a password: swaylock authenticates through
-  # pam_unix, and without a /etc/shadow entry the screen cannot be unlocked.
   services.greetd.settings.initial_session = {
     command = "${pkgs.niri}/bin/niri-session";
-    user = "kresdo";
+    user = config.moonarch.user;
   };
 
   # Development access from the host via the QEMU port forward on 127.0.0.1:2222.