scripts: add enable-fingerprint.sh (one-time PAM bootstrap)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/enable-fingerprint.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# enable-fingerprint.sh — wire pam_fprintd.so into sudo + gtklock auth stacks.
+# Idempotent: re-runs are no-ops once the line is present. Run with sudo.
+# Prerequisite: fprintd installed and at least one finger enrolled
+# (run `fprintd-enroll` as your user first).
+
+set -euo pipefail
+
+if [ "$EUID" -ne 0 ]; then
+    echo "Run as root: sudo bash $0" >&2
+    exit 1
+fi
+
+if ! command -v fprintd-enroll >/dev/null 2>&1; then
+    echo "ERROR: fprintd is not installed. Run install.sh first." >&2
+    exit 1
+fi
+
+PAM_LINE="auth      sufficient    pam_fprintd.so"
+TARGETS=(/etc/pam.d/sudo /etc/pam.d/gtklock)
+
+for f in "${TARGETS[@]}"; do
+    if [ ! -f "$f" ]; then
+        echo "ERROR: $f does not exist. Is the corresponding package installed?" >&2
+        exit 1
+    fi
+
+    if grep -q "pam_fprintd" "$f"; then
+        echo "$f: pam_fprintd already present — skipping"
+        continue
+    fi
+
+    backup="$f.bak.$(date +%s)"
+    cp -a "$f" "$backup"
+    echo "$f: backed up to $backup"
+
+    # Insert PAM_LINE on a new line directly before the first `auth ` directive.
+    awk -v line="$PAM_LINE" '
+        !inserted && /^auth[[:space:]]/ { print line; inserted = 1 }
+        { print }
+    ' "$f" > "$f.new"
+
+    if ! grep -q "pam_fprintd" "$f.new"; then
+        echo "ERROR: failed to insert PAM line into $f (no auth directive found?). Restoring backup." >&2
+        rm -f "$f.new"
+        exit 1
+    fi
+
+    mv "$f.new" "$f"
+    chmod --reference="$backup" "$f"
+    echo "$f: inserted '$PAM_LINE'"
+done
+
+echo
+echo "Done. Test with: sudo true   (should prompt for fingerprint)"
+echo "Or lock the screen (Mod+Shift+E) and touch the reader."
+echo
+echo "To revert: restore the .bak.<ts> files in /etc/pam.d/, or:"
+echo "  sudo sed -i '/pam_fprintd/d' ${TARGETS[*]}"