feat(desktop): provide Secret Service via gnome-keyring

Bare Wayland session ships no `org.freedesktop.secrets` provider, so
libsecret/qtkeychain apps can't persist credentials. Run gnome-keyring
and unlock it at the greetd login via PAM.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home.nix

@@ -353,6 +353,10 @@ in
   # Notification daemon. notify-send clients (e.g. imv's info/delete toasts in
   # modules/media.nix, gpg-agent errors) need a running server on the bus.
   # Minimal to match the desktop: Nerd Font, no rounding, square border.
+  # Secret Service provider (freedesktop org.freedesktop.secrets). Bare Wayland
+  # session has none otherwise; apps using libsecret/qtkeychain need it.
+  services.gnome-keyring.enable = true;
+
   services.mako = {
     enable = true;
     settings = {

modules/nixos.nix

@@ -92,6 +92,10 @@
     };
   };
 
+  # Unlock the login keyring with the login password at the greetd prompt,
+  # so the Secret Service is open without a second passphrase.
+  security.pam.services.greetd.enableGnomeKeyring = true;
+
   # XDG portals (screen sharing, file pickers, and so on).
   xdg.portal = {
     enable = true;