docs(sway): note the Wayland greeter login in READMEs

Document the greetd/ReGreet greeter in the top-level README and the T400
and Mac Pro install notes, including that the user account needs a
password set before the greeter can authenticate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -28,6 +28,16 @@ sudo nixos-rebuild switch --flake .#<configuration>
 darwin-rebuild switch --flake .#lyrathorpe-mac
 ```
 
+## Login / greeter
+
+Graphical (Sway) hosts log in through a Wayland greeter — `greetd` running
+ReGreet inside the `cage` kiosk compositor — configured centrally in
+[`lyrathorpe/swaywm.nix`](./lyrathorpe/swaywm.nix), gated on
+`features.swayDesktop.enable`. The greeter is forced to Dvorak to match the
+console and Sway session. Hosts with `features.swayDesktop.enable = false` (the
+WSL work box) keep plain TTY login. The target account needs a password
+(`passwd <user>`) before it can log in.
+
 ## MacBook (Asahi) firmware
 
 The MBP host references `system/modules/firmware/` for Apple peripheral

lyrathorpe/swaywm.nix

@@ -45,6 +45,25 @@ in
       font-awesome
     ];
 
+    # Wayland login screen (replaces console/getty login on every Sway host).
+    # greetd runs ReGreet inside the cage kiosk compositor; the Sway session is
+    # offered automatically because programs.sway registers itself via
+    # services.displayManager.sessionPackages. Hosts that turn off
+    # features.swayDesktop (e.g. EDaaS) keep plain TTY login.
+    programs.regreet.enable = true;
+    # cage reads the XKB_* environment at startup, so force the greeter onto the
+    # same Dvorak layout as the console (workstation.nix) and the Sway session
+    # (home/sway.nix) -- otherwise the password field would be QWERTY. This
+    # overrides the greetd command regreet sets with mkDefault.
+    services.greetd.settings.default_session.command =
+      let
+        greeter = pkgs.writeShellScript "regreet-cage" ''
+          export XKB_DEFAULT_LAYOUT=dvorak
+          exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe config.programs.regreet.package}
+        '';
+      in
+      "${greeter}";
+
     # Desktop portals: enables screen sharing (wlroots) and native file pickers
     # for Wayland apps such as Element and Firefox.
     xdg.portal = {

system/machine/MacPro31/README.md

@@ -44,6 +44,15 @@ These come up automatically. If a card needs forcing, set
 Wired Ethernet via NetworkManager (from `desktop.nix`) — the Mac Pro has two
 gigabit ports.
 
+## Login
+
+Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
+`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
+every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
+to the Dvorak layout to match the console and Sway session. Set the user
+password (`passwd lyrathorpe`) after install, or the greeter cannot
+authenticate. Requires working KMS (radeon/nouveau — see Graphics).
+
 ## Apply
 
 ```sh

system/machine/T400/README.md

@@ -32,6 +32,15 @@ The T400 has switchable graphics (discrete ATI + Intel GMA 4500MHD). Select
 run **Integrated** instead, the Intel `i915` driver takes over with no config
 change and `radeon` stays idle.
 
+## Login
+
+Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
+`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
+every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
+to the Dvorak layout to match the console and Sway session. Set the user
+password (`passwd lyrathorpe`) after install, or the greeter cannot
+authenticate. Requires working radeon/i915 KMS (see Graphics).
+
 ## Apply
 
 ```sh