feat(deploy): authorize bitspire for pcscd (polkit) + NFC diagnostics

pcscd gates clients via polkit; the sandboxed bitspire user was "Rejected
unauthorized PC/SC client", so add a polkit rule granting it
access_pcsc/access_card. Also log NFC reader status + taps from the main
process to journald (value redacted — it carries the card's SUN p/c) so
reader detection and taps are observable during testing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/machine/electron/main.ts

@@ -833,8 +833,17 @@ app.whenReady().then(() => {
   // best-effort: if the reader/pcscd is absent it just reports 'unavailable'
   // and the cash-out QR path is unaffected.
   void startNfcReader(
-    (lnurlw) => mainWindow?.webContents.send('nfc:card-tapped', lnurlw),
-    (status) => mainWindow?.webContents.send('nfc:status', status)
+    (lnurlw) => {
+      // Don't log the value — it carries the card's single-use SUN p/c.
+      console.log(`[NFC] card tapped — lnurlw (${lnurlw.length} chars) → renderer`)
+      mainWindow?.webContents.send('nfc:card-tapped', lnurlw)
+    },
+    (status: NfcStatus) => {
+      console.log(
+        `[NFC] status=${status.state}${status.reader ? ` reader="${status.reader}"` : ''}${status.message ? ` — ${status.message}` : ''}`
+      )
+      mainWindow?.webContents.send('nfc:status', status)
+    }
   )
 
   app.on('activate', () => {