fix(desktop): don't prompt on ssh presence/confirm askpass calls

Forced askpass routes the "Confirm user presence" touch notifications
(SSH_ASKPASS_PROMPT=none) through the helper too, which blindly asked for a
PIN — three dialogs per push. Only prompt for the real passphrase; let the
informational calls succeed silently (the FIDO touch is hardware-enforced).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/home.nix

@@ -13,7 +13,13 @@ let
   # SSH_ASKPASS helper that drives the GPG pinentry-qt: ssh passphrase/PIN
   # prompts reuse the same Qt dialog as commit signing, adding no extra GUI
   # toolkit (a packaged askpass would drag in KDE/GTK — hundreds of MB).
+  # ssh signals the prompt kind via $SSH_ASKPASS_PROMPT (OpenSSH ≥ 8.4):
+  #   empty          real passphrase/PIN entry — collect input, echo to stdout
+  #   confirm/none   informational, e.g. "Confirm user presence" (touch request)
+  # A FIDO touch can't be faked by software, so those messages need no dialog:
+  # succeed silently instead of popping a spurious PIN box (the token blinks).
   sshAskpass = pkgs.writeShellScript "ssh-askpass-pinentry" ''
+    [ -n "''${SSH_ASKPASS_PROMPT:-}" ] && exit 0
     desc=$(printf '%s' "''${1:-Passphrase:}" | sed 's/%/%25/g')
     printf 'SETTITLE ssh\nSETPROMPT PIN:\nSETDESC %s\nGETPIN\nBYE\n' "$desc" \
       | ${pkgs.pinentry-qt}/bin/pinentry-qt \