feat: add PAM-backed autologin

[rogervn]

Summary

Add PAM autologin config

This is interesting for enabling seamless login from LUKS. This is better than skipping login altogether because this will also propagate to the keyring.

Happy to receive feedback and change the strategy here.

Motivation

greetd’s initial_session bypasses PAM authentication, which prevents setups using a systemd initrd and pam_systemd_loadkey from unlocking a credential store during autologin.

This provides a greeter-side authenticated autologin path while retaining a safe interactive fallback.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring
• Build / packaging

Related Issue

None

Testing

Ran it locally and verified that the LUKS password got propagated to login and that keyring did unlock without prompting for a password.

Config added:

[user]
default = USER

[auth]
autologin = true

Manual Coverage

• Tested under greetd (real login flow)
• Tested with just run / just run-local (dev compositor)
• Tested with multiple monitors
• Tested appearance sync from Noctalia Shell (Sync Now)
• Tested on NixOS (programs.noctalia-greeter)
• Tested with a pinned [output].name
• Tested with custom [output].layout / [output].transforms

Screenshots / Videos

Checklist

• This PR is ready for review, or it is marked as Draft.
• I read and followed the relevant guidance in AGENTS.md and README.md.
• I ran just format with clang-format v22+ installed, or this PR has no code changes.
• I ran the relevant build or test commands, or explained why they were not run.
• I self-reviewed the changes.
• I checked for new warnings or errors.
• I will update end-user documentation in noctalia-docs after merge, or this PR does not change user-facing configuration or behavior.
• I used the existing canonical names for config keys, paths, and identifiers.

Additional Notes