refactor(system-manager): extract unix_chkpwd wrapper into a module

The setuid /run/wrappers/bin/unix_chkpwd wrapper is generic plumbing that
nixpkgs' pam_unix requires (system-manager, unlike NixOS, doesn't provide
it), not host policy. Move it to modules/system-manager/unix-chkpwd.nix,
applied unconditionally like NixOS does; hosts/.../pam.nix keeps only the
pam.d stacks.

Assisted-by: pi (claude-opus-4-8)

hosts/system-manager/common/global/pam.nix

@@ -10,17 +10,6 @@
     auth      required                   ${pamSecurity}/pam_permit.so
   '';
 in {
-  # nixpkgs' pam_unix execs its verification helper from the fixed path
-  # /run/wrappers/bin/unix_chkpwd, so pam_unix auth silently fails until that
-  # setuid wrapper exists. Provide it (as NixOS does) so pam_unix works for
-  # both root callers (greetd) and unprivileged ones (hyprlock).
-  security.wrappers.unix_chkpwd = {
-    setuid = true;
-    owner = "root";
-    group = "root";
-    source = "${pkgs.linux-pam}/bin/unix_chkpwd";
-  };
-
   environment.etc = {
     # Ours (Ubuntu ships no greetd/hyprlock), but a prior System Manager
     # activation can leave them on disk without recording them in its etc

modules/system-manager/default.nix

@@ -1,4 +1,5 @@
 {
   hydra-auto-upgrade = import ./hydra-auto-upgrade.nix;
   nix-registry = import ./nix-registry.nix;
+  unix-chkpwd = import ./unix-chkpwd.nix;
 }

modules/system-manager/unix-chkpwd.nix

@@ -0,0 +1,13 @@
+# nixpkgs' pam_unix execs its verification helper from the fixed path
+# /run/wrappers/bin/unix_chkpwd, so pam_unix auth silently fails until that
+# setuid wrapper exists. system-manager doesn't provide it (NixOS does), so set
+# it up unconditionally for any nix PAM caller — root (e.g. greetd) and
+# unprivileged (e.g. hyprlock) alike.
+{pkgs, ...}: {
+  security.wrappers.unix_chkpwd = {
+    setuid = true;
+    owner = "root";
+    group = "root";
+    source = "${pkgs.linux-pam}/bin/unix_chkpwd";
+  };
+}