enroll-biometrics.sh used non-existent howdy flags and a broken install
path. Fixes and additions:
- howdy add: label has no flag; feed it via stdin, use -U "$USER"
- howdy remove: id is positional, not -I
- list/test: pass -U "$USER" so all ops target the same account
- install: howdy is AUR-only, so the pacman fallback could never work;
require an AUR helper (yay/paru) and message clearly if absent
- new PAM 2FA menu: enroll FIDO key + wire howdy + pam_u2f into
sudo/hyprlock/login (both factors required, password fallback kept)
- hyprlock gets its own clean fallback (include system-auth) so the
block is not re-run via include login
- idempotent, timestamped backups, and a symmetric teardown option
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Amir Alexander Abdelbaki
d35d6d17d6