fix(hub): make Hub login verification loadable and diagnosable

Correction to the patch-0002 report: after a reboot the Hub icon asks for a password AND the correct free (desktop) password is rejected there, while desktop sign-in accepts it. Patch 0002/0003 explain the icon prompt (legacy hub_manual_logout cookie; fixed in 0003), but the rejection itself means verify_system_password() never gets a conclusive crypt answer in the Hub unit and its PAM fallback cannot load either: on NixOS a bare libcrypt.so.1/libpam.so.0 resolves through LD_LIBRARY_PATH or not at all (or to glibc's failure-token stub), and until now every stage failed silently into a generic 'Incorrect password'.

password-model.nix now puts pkgs.libxcrypt and pkgs.pam on sovran-hub-web's LD_LIBRARY_PATH so both the crypt fallbacks and PAM can actually load. verify_system_password() now logs, journal-visible and never containing a password or hash: the shadow hash scheme, every libcrypt source tried and whether it loaded, and PAM's service + return code when it has to decide.

modules/password-model.nix

@@ -149,4 +149,12 @@ in
 
   # ── 3. The Hub verifies passwords against /etc/shadow via libxcrypt ───────
   systemd.services.sovran-hub-web.environment.LIBCRYPT = "${pkgs.libxcrypt}/lib/libcrypt.so.1";
+  # ctypes fallback lookups (bare "libcrypt.so.1" / "libpam.so.0") resolve
+  # through LD_LIBRARY_PATH inside the unit. Without this they find nothing
+  # on NixOS (no ld.so.conf paths) or glibc's failure-token libcrypt stub,
+  # whose "*0"/NULL answers read as a wrong password at Hub login even
+  # though the same password signs in at the desktop. Put the real
+  # libxcrypt and PAM libraries on the Hub's library path.
+  systemd.services.sovran-hub-web.environment.LD_LIBRARY_PATH =
+    lib.makeLibraryPath [ pkgs.libxcrypt pkgs.pam ];
 }