feat(terra): replace tuigreet with a quickshell greeter

greetd now runs a throwaway Hyprland hosting dotfiles/quickshell/greeter.qml,
configured per host via homelab.greeter.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -210,3 +210,9 @@ kept its ssh host key. Run it after ANY change to the kexec paths.
 - **`kexec-local` stages on `/var/tmp`, not `/tmp`**: `kexec-run.sh` appends a fresh cpio
   to `kexec/initrd` in place and execs binaries from that dir, so a size-capped or
   `noexec` tmpfs gives a half-written initrd or a bare "Permission denied".
+- **terra's greeter is a throwaway Hyprland running `dotfiles/quickshell/greeter.qml`**
+  (`services/desktop/quickshell-greeter.nix`). It must exit after login or greetd never
+  starts the session, and with a Lua config `hyprctl dispatch exit` is REJECTED — it needs
+  `hyprctl dispatch 'hl.dsp.exit()'`. Test the flow without touching the real greetd by
+  running greetd's `fakegreet "qs -p …/greeter.qml"` inside a nested Hyprland
+  (user `user`, password `password`, then answer `9`).