feat: unify monospace typography and style the One Ring greeter

DESKTOP.md

@@ -5,6 +5,8 @@ Reviewed 2026-09-06 UTC on the physical laptop and against the pinned upstream s
 ## Design
 
 - Dark **One Ring** wallpaper, charcoal surfaces, parchment text and restrained old-gold accents. Terminal ANSI colors remain distinct; Neovim's theme and configuration are unchanged.
+- **JetBrains Mono Nerd Font** throughout the system/UI defaults, with Noto emoji/CJK fallbacks. GTK, Qt's GTK integration, native desktop components and the lock screen share it; explicit website fonts and Tor Browser privacy settings are not overridden.
+- **SDDM Astronaut** is styled with the same static wallpaper, gold accents and monospace typography. The left-side login form leaves the artwork visible, with no animated background or blur. Only the greeter's presentation changes: no host autologin, PAM/password edits or bootloader changes.
 - One continuous top bar: launcher/workspaces/help and active-window context on the left, date/time in the center, media, CPU/RAM/temperature, notification count, privacy and laptop status on the right. Details and actions are available without filling the bar with permanent buttons.
 - The bar's quick-settings panel owns audio, microphone, brightness, network/VPN, Bluetooth, power profiles and idle inhibition. Its **Actions** and **Health** buttons open the action palette and real system/update diagnostics.
 - SwayNC owns notification history, actions, DND and media—not a duplicate hardware settings dashboard.
@@ -62,6 +64,8 @@ The native audit caught real issues that configuration evaluation did not: neste
 
 `desktop-test.py` exercises the disposable graphical VM using the same SDDM/UWSM workstation module as the laptop: session ownership, fonts, real PipeWire nodes, launcher geometry at 100%/150%, clipboard picker, recording container and no-audio default, notification ownership/inhibition, described help, and real wrong/correct-password PAM locking. Test credentials never reach the host. `desktop-actions-test.py` covers cancellation, untrusted input, byte-preserving clipboard behavior, lock failure handling, display timeout restoration and recording-inhibitor cleanup.
 
+`nix build .#checks.x86_64-linux.appearance --out-link /tmp/workstation-appearance` checks generic font matching, emoji/CJK fallback and shared UI settings, then renders the actual packaged Qt6 SDDM greeter in test mode inside a disposable 1920×1080 Xvfb display. Its `greeter.png` and `greeter.log` are suitable for review without logging out, restarting SDDM or authenticating anyone. This is a theme rendering check, not a new real-password login test.
+
 **Completed validation (2026-09-06):** flake evaluation, Nix formatting, generated Hyprland configuration, physical/AWS/shared-policy assertions, 125 CLI executable smoke checks, 14 desktop-action tests, 23 updater regressions, 22 manual-switch regressions (including lock retention through sudo), both host system builds, and the full SDDM/UWSM graphical/PAM/clipboard/recording VM check all passed on the refreshed inputs. Native clipboard, recording and rootless Podman checks passed too. The 150% six-result launcher and help screenshots were inspected visually; the transparent launcher click-catcher's IPC dimensions are not mistaken for the visible palette bounds.
 
 **Account/hardware boundaries:**