Fix KDE Plasma login integration

[Archmonger]

Summary

When you use biopass for fingerprint authentication, it works great for sudo and in session lock screens but it has two problems. First, system popup dialogs (like the KDE authentication prompts) don't accept your fingerprint. Second, the login screen where you first sign in to your computer doesn't support fingerprint at all. This pull request fixes both.

Issue Breakdown

1. The first issue was that biopass helper runs as root when it's forked from the PAM module. It then calls fprintd over D-Bus to verify your fingerprint. But fprintd looks up fingerprint templates using the caller's UID. Root has UID 0 and root has no enrolled fingers. So fprintd always says there is no match and the dialog falls through to a password prompt.
   • Fix: Added a privilege dropping step to the helper. Before calling fprintd it drops from root to the target user using initgroups, setgid, and setuid. Now fprintd looks up the correct user's templates and verification works properly. Also added an 8 second alarm timeout around the waitpid call so if the helper ever hangs the login screen will not freeze.
2. The second issue was that the PAM stack at the login screen had no fingerprint support at all. biopass PAM module is designed for face and fingerprint authentication inside a running desktop session. But at the login screen there is no display server yet so face auth can't work. The module skipped itself and no other module handled fingerprint.
   • Fix: added pam_fprintd.so to the system-auth PAM stack right before biopass. It has a 5 second timeout and one retry attempt. Now when you click Login at the greeter a fingerprint prompt appears. Swipe your finger and you are in. If you don't swipe it falls through to the password prompt.
3. Discovered some build issues with libcamera while trying to fix my issues above
   • fix: Add Dwerror=false to the meson configure step. Without this the build fails on GCC 16 and newer.

Files Changed

auth/pam/pam.cc - Added alarm timeout and display detection
auth/pam/helper.cc - Added privilege dropping to the target user
auth/fingerprint/fingerprint_auth.cc - Retry logic for device claim conflicts
auth/BundleLibcamera.cmake - Dwerror=false for modern compilers
docs/PAM.md - Modify arch docs to utilize pam_fprintd.so

Related discussion or issue

No discussion link. This was a quick fix I developed to resolve the bugs I was seeing.

Impact

People using biopass with Plasma (KDE) or other display managers on Wayland will be able to log in with their fingerprint without the password fallback.

Verification

• Distro: CachyOS (Arch based), rolling release
• Package format tested: source build
• Desktop environment or display manager: Plasma 6 on Wayland with plasmalogin
• PAM file or distro auth tool involved: /etc/pam.d/system-auth includes libbiopass_pam.so

I tested by running /usr/bin/biopass-helper auth --username mark --no-display and watching journalctl for fprintd activity. The helper connected to fprintd over D-Bus and started the fingerprint reader without crashing or hanging when no display was present.

Distro notes

• Distro and version: CachyOS
• Desktop environment: KDE Plasma 6 on Wayland
• Display manager: plasmalogin (SDDM replacement)

Contributor checklist

• I wrote this PR description myself.
• I opened a discussion first if this changes dependencies, flows, features, or broad behavior.
• I included clear evidence for the behavior or distro impact.
• I updated docs when behavior, installation, packaging, or distro support changed.