feat(sway): polkit agent, kanshi, night-light, idle-inhibit, lid policy

- Polkit authentication agent (lxqt-policykit) as a sway-session user
  service — programs.sway only enables the daemon, so GUI auth dialogs
  (nemo mount, NM/blueman) previously failed silently. Corrected the
  header comment that wrongly claimed the agent was handled system-side.
- kanshi for output/display management (safe internal-panel default; a
  documented template for docked/Cinema-Display profiles).
- gammastep night-light (manual location; adjust coordinates).
- inhibit_idle on fullscreen so video doesn't get blanked/locked.
- logind lid policy on the laptops: suspend on battery, lock on AC.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

system/modules/laptop.nix

@@ -13,6 +13,13 @@
     settings.General.EnableNetworkConfiguration = true;
   };
 
+  # Lid behaviour: suspend on battery, lock on external power (swayidle's
+  # before-sleep hook locks before the suspend completes either way).
+  services.logind.settings.Login = {
+    HandleLidSwitch = "suspend";
+    HandleLidSwitchExternalPower = "lock";
+  };
+
   # Bluetooth. The Asahi MBP loads Apple's BT firmware (see its host config) and
   # the T400 has an optional BT module; enable bluez on both, with blueman as the
   # GUI/tray manager for the Sway session.