greetd's PAM stack included system-login, whose own pam_u2f line runs
before the password stack — combined with greetd's own trailing
pam_u2f line, ReGreet prompted FIDO, then password, then FIDO again.
Spell out system-login's auth phase minus that stray line so FIDO is
asked once, after the password, matching hyprlock's order.
Also add setup/tools/set-regreet-background.sh to pin a specific image
as the greeter background, independent of the wallpaper-sync unit.
