docs: document smart-card / PIV login

[hanthor]

Summary

• document the current TunaOS smart-card/PIV package baseline
• provide PKCS#11/OpenSC installation, trust, mapping, and PAM guidance
• explain card-removal policy and bootc update/configuration ownership

Closes #346

— hive: backend=pi model=openai-codex/gpt-5.6-luna

[hanthor]

Triage note — leaving open as real work; two things block an automated merge.

1. The branch is conflicted. mergeable_state is dirty. sidebars.ts has moved since this branch was cut, and that is the only shared file, so the resolution should be mechanical — re-add 'tunaos/smart-card-login' to the Developer Guide items array on top of current main.

2. The content needs a maintainer with TunaOS image knowledge. This is authentication documentation, and its central claims are about what the images actually ship — for example "the current TunaOS image build does not preconfigure smart-card login", that the package lists omit pam_pkcs11/OpenSC/pcsc-lite, and that sssd in the EL10 service setup is standard login integration rather than certificate enrollment. Those are verifiable, but only against tuna-os/tunaOS, which is outside this triage pass's scope. Getting them wrong in a security guide is worse than not shipping the page, so I did not want to merge it on a conflict resolution alone.

The writing itself is appropriately hedged — it tells the reader to confirm the baseline with rpm -q rather than trusting the page, keeps a fallback login throughout, and explicitly declines to claim card-removal locking without a tested watcher. That is the right posture. It just needs someone who can confirm the baseline.

---

Generated by Claude Code