feat(sway): add greetd + ReGreet Wayland greeter for Sway hosts

Replace TTY/getty login with a graphical Wayland greeter on every host
with features.swayDesktop enabled (MBP, T400, Mac Pro; not the WSL box).
greetd launches ReGreet inside the cage kiosk compositor; the Sway
session is listed automatically via services.displayManager.sessionPackages.

Override regreet's mkDefault greetd command to export
XKB_DEFAULT_LAYOUT=dvorak so the greeter password field matches the
console (workstation.nix) and Sway session (home/sway.nix) layout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lyrathorpe/swaywm.nix

@@ -45,6 +45,25 @@ in
       font-awesome
     ];
 
+    # Wayland login screen (replaces console/getty login on every Sway host).
+    # greetd runs ReGreet inside the cage kiosk compositor; the Sway session is
+    # offered automatically because programs.sway registers itself via
+    # services.displayManager.sessionPackages. Hosts that turn off
+    # features.swayDesktop (e.g. EDaaS) keep plain TTY login.
+    programs.regreet.enable = true;
+    # cage reads the XKB_* environment at startup, so force the greeter onto the
+    # same Dvorak layout as the console (workstation.nix) and the Sway session
+    # (home/sway.nix) -- otherwise the password field would be QWERTY. This
+    # overrides the greetd command regreet sets with mkDefault.
+    services.greetd.settings.default_session.command =
+      let
+        greeter = pkgs.writeShellScript "regreet-cage" ''
+          export XKB_DEFAULT_LAYOUT=dvorak
+          exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe config.programs.regreet.package}
+        '';
+      in
+      "${greeter}";
+
     # Desktop portals: enables screen sharing (wlroots) and native file pickers
     # for Wayland apps such as Element and Firefox.
     xdg.portal = {