fix(modules): guard remaining interactive prompts for unattended installs

Audited every module for prompts that would hang an answerfile/unattended run.
The EWW form-factor question and several interactive-config modules were still
unguarded (only hyprlua had been fixed):

- hyprland.sh, niri.sh: skip the EWW form-factor `read` when MARCHY_UNATTENDED=1
  or stdin is not a TTY, defaulting to the desktop/no-battery bar (matches hyprlua).
- mail-notmuch.sh, caldav-sync.sh: install the tools, then exit cleanly in
  unattended mode instead of blocking on the account/server credential prompts —
  the user configures the account after first boot.
- freeipa-server.sh: bail out early in unattended mode; FreeIPA server provisioning
  is interactive and must run on a booted system (ipa-server-install needs running
  services), so it can never run during the install.

freeipa-client.sh is left as-is: it has a genuine --unattended enrolment path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R5kHioUMK3mtf2eiLEozCM

setup/modules/Desktop-Environments/hyprland.sh

@@ -211,9 +211,16 @@ log "Setting up EWW bar..."
 # with the freshly copied one.
 rm -rf ~/.config/eww
 
-# Prompt for form factor with a single keypress (no Enter needed).
-read -n1 -p "Install eww bar for PC, Notebook or Tablet [P/N/T]: " doit
-echo  # Print newline so subsequent output starts on a fresh line
+# Prompt for form factor with a single keypress (no Enter needed). In unattended
+# installs (answerfile mode) or when stdin is not a terminal, skip the prompt and
+# default to the desktop/no-battery layout so the install never blocks on input.
+if [[ "${MARCHY_UNATTENDED:-0}" == "1" || ! -t 0 ]]; then
+    doit="P"
+    log "Unattended mode — installing desktop (no-battery) EWW bar."
+else
+    read -n1 -p "Install eww bar for PC, Notebook or Tablet [P/N/T]: " doit
+    echo  # Print newline so subsequent output starts on a fresh line
+fi
 
 case $doit in
     # Notebook: copy the battery-aware layout

setup/modules/Desktop-Environments/niri.sh

@@ -47,8 +47,16 @@ yay -Syu --answerdiff None --answerclean All --noconfirm --needed \
 # 5. EWW bar selection and compilation
 log "Setting up EWW bar..."
 rm -rf ~/.config/eww
-read -n1 -p "Install eww bar for PC, Notebook or Tablet [P/N/T]: " doit
-echo
+# Skip the form-factor prompt in unattended installs (answerfile mode) or when
+# stdin is not a terminal; default to the desktop/no-battery layout so the
+# install never blocks waiting for a keypress.
+if [[ "${MARCHY_UNATTENDED:-0}" == "1" || ! -t 0 ]]; then
+    doit="P"
+    log "Unattended mode — installing desktop (no-battery) EWW bar."
+else
+    read -n1 -p "Install eww bar for PC, Notebook or Tablet [P/N/T]: " doit
+    echo
+fi
 case $doit in
     n|N) cp -rf ~/Dotfiles/desktopenvs/niri/eww/ ~/.config/ ;;
     p|P) cp -rf ~/Dotfiles/desktopenvs/niri/eww-nobattery/ ~/.config/eww ;;

setup/modules/optional-Modules/apps/caldav-sync.sh

@@ -33,6 +33,14 @@ source "$(dirname "${BASH_SOURCE[0]}")/../../lib/logging.sh"
 log "Installing CalDAV sync stack..."
 sudo pacman -S --noconfirm --needed vdirsyncer khal python-icalendar
 
+# In unattended installs (answerfile mode / no TTY) there is no operator to answer
+# the server prompts below, so install the tools and stop cleanly here; the user
+# configures their CalDAV account after first boot.
+if [[ "${MARCHY_UNATTENDED:-0}" == "1" || ! -t 0 ]]; then
+    skip "Unattended mode — CalDAV tools installed; configure the account after first boot."
+    exit 0
+fi
+
 # ── Credentials ───────────────────────────────────────────────────────────────
 # Collect the minimum information needed to configure vdirsyncer.
 # -r = raw input (no backslash escaping), -p = prompt, -s = silent (password)

setup/modules/optional-Modules/apps/freeipa-server.sh

@@ -9,6 +9,15 @@ source "$(dirname "${BASH_SOURCE[0]}")/../../lib/logging.sh"
 
 log "Starting FreeIPA server installer..."
 
+# FreeIPA server provisioning is interactive and must run on a fully booted system
+# (ipa-server-install needs running DNS/Kerberos/dirsrv services). It cannot run in
+# the install chroot or unattended, so bail out cleanly there instead of hanging on
+# the configuration prompts below.
+if [[ "${MARCHY_UNATTENDED:-0}" == "1" || ! -t 0 ]]; then
+    skip "Unattended mode — run the FreeIPA server installer manually after first boot."
+    exit 0
+fi
+
 RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
 BLUE='\033[0;34m'; CYAN='\033[0;36m'; MAGENTA='\033[0;35m'; NC='\033[0m'
 

setup/modules/optional-Modules/apps/mail-notmuch.sh

@@ -9,6 +9,14 @@ log "Installing mail stack (isync, msmtp, notmuch, alot, w3m)..."
 # alot: terminal mail UI built on notmuch; w3m: renders HTML mail parts as plain text.
 sudo pacman -S --noconfirm --needed isync msmtp notmuch alot w3m
 
+# In unattended installs (answerfile mode / no TTY) there is no operator to answer
+# the account prompts below, so install the tools and stop cleanly here; the user
+# configures their mail account after first boot.
+if [[ "${MARCHY_UNATTENDED:-0}" == "1" || ! -t 0 ]]; then
+    skip "Unattended mode — mail stack installed; configure accounts after first boot."
+    exit 0
+fi
+
 # ── Credentials ───────────────────────────────────────────────────────────────
 # Collect all account details interactively before writing any config files,
 # so the user can review/abort cleanly before any files are touched.