feat(desktop): GUI askpass for ssh passphrase/PIN prompts

Add ksshaskpass and point SSH_ASKPASS at it, without forcing: a tty still
prompts inline, but a caller may set SSH_ASKPASS_REQUIRE to route the prompt
to the GUI (e.g. a headless context driving `git push`).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home.nix

@@ -36,6 +36,10 @@ in
     # Mute the harmless "Wayland does not support QWindow::requestActivate()"
     # spam Qt apps (keepassxc) print; scoped to that one log category only.
     QT_LOGGING_RULES = "qt.qpa.wayland=false";
+    # GUI helper for ssh passphrase/PIN prompts. Not forced: with a tty ssh still
+    # prompts inline; the helper is only used when a caller sets
+    # SSH_ASKPASS_REQUIRE (e.g. a headless/agent context).
+    SSH_ASKPASS = "${pkgs.ksshaskpass}/bin/ksshaskpass";
   };
   # Sets XDG_{CONFIG,DATA,CACHE}_HOME and enables xdg.configFile management.
   xdg.enable = true;
@@ -49,6 +53,7 @@ in
     nodejs
     highlight   # `ccat` alias: syntax-highlighted cat
     libreoffice
+    ksshaskpass   # Qt GUI prompt for ssh passphrase/PIN (see SSH_ASKPASS above)
   ];
 
   # ---- Per-tool config files, routed into XDG dirs ---------------------