feat(deploy): services.bitspire.nfc.enable — declare the reader per machine

pcscd was enabled in hardware/batm3.nix and hardware/upboard.nix, which
cannot express "is a reader fitted": upboard.nix is shared by sintra (HID
Global OMNIKEY 5022) and tejo (nothing fitted), so tejo inherited pcscd it
has no use for, while the douro — with its own hardware file — got none and
wedged on every boot.

Make it a machine capability instead. services.bitspire.nfc.enable owns
pcscd, the two polkit rules and the wedge-recovery unit, and hands the app
a BITSPIRE_NFC_ENABLED flag so it doesn't initialise nfc-pcsc at all on a
machine with no reader. Per-model truth lives in nfcReaderForModel in
flake.nix next to fiatCodeForModel and upgradeWindowForModel, since a
shared hardware file can't answer the question. batm3 and sintra are true;
douro and tejo flip to true when readers are fitted.

The flag goes through the unit's Environment rather than
/var/lib/bitspire/.env, because .env is only written when absent — a
machine provisioned months ago would never pick up a new value.

deploy/nixos/hardware/batm3.nix

@@ -85,65 +85,10 @@
     cpuFreqGovernor = "performance";
   };
 
-  # PC/SC daemon for the Feitian KP382 contactless reader (096e:0608, a CCID
-  # smart-card reader) used for Bolt Card tap-to-pay on cash-out. Enabling it
-  # binds the CCID driver to the reader; the app talks to pcscd's socket (via
-  # nfc-pcsc) rather than the USB device directly. Harmless if no reader is
-  # attached — pcscd just idles.
-  services.pcscd.enable = true;
-
-  # pcscd gates client access via polkit; without a rule the sandboxed
-  # `bitspire` service user is "Rejected unauthorized PC/SC client". Authorize
-  # it to talk to the daemon and the card. The second rule lets the app trigger
-  # the NFC reader wedge-recovery service (see nfc-reader-reset below).
-  security.polkit.extraConfig = ''
-    polkit.addRule(function(action, subject) {
-      if ((action.id == "org.debian.pcsc-lite.access_pcsc" ||
-           action.id == "org.debian.pcsc-lite.access_card") &&
-          subject.user == "bitspire") {
-        return polkit.Result.YES;
-      }
-    });
-    polkit.addRule(function(action, subject) {
-      if (action.id == "org.freedesktop.systemd1.manage-units" &&
-          action.lookup("unit") == "nfc-reader-reset.service" &&
-          subject.user == "bitspire") {
-        return polkit.Result.YES;
-      }
-    });
-  '';
-
-  # NFC reader wedge-recovery. The Feitian R502-CL CCID reader (and, less often,
-  # any CCID reader) can wedge: it keeps detecting a card but every APDU returns
-  # "card absent or mute", and ONLY a USB power-cycle clears it — restarting
-  # pcscd or the app does not. This oneshot re-binds the reader's USB device (a
-  # software replug); pcscd + nfc-pcsc then re-detect it on hotplug with no app
-  # restart (verified on-device). The app (unprivileged `bitspire`) starts it via
-  # the polkit rule above when it sees repeated read failures. Reader-agnostic:
-  # it matches the USB CCID interface class (0x0B), so it also covers a future
-  # ACR1252U swap without a config change.
-  systemd.services.nfc-reader-reset = {
-    description = "Power-cycle a wedged CCID NFC reader (USB re-bind)";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.writeShellScript "reset-nfc-reader" ''
-        set -u
-        found=0
-        for iface in /sys/bus/usb/devices/*:*/bInterfaceClass; do
-          [ -f "$iface" ] || continue
-          [ "$(${pkgs.coreutils}/bin/cat "$iface" 2>/dev/null)" = "0b" ] || continue
-          ifname=$(${pkgs.coreutils}/bin/basename "$(${pkgs.coreutils}/bin/dirname "$iface")")
-          dev=''${ifname%%:*}
-          echo "reset-nfc-reader: power-cycling CCID reader USB device $dev" >&2
-          echo -n "$dev" > /sys/bus/usb/drivers/usb/unbind 2>/dev/null || true
-          ${pkgs.coreutils}/bin/sleep 2
-          echo -n "$dev" > /sys/bus/usb/drivers/usb/bind 2>/dev/null || true
-          found=1
-        done
-        [ "$found" = 1 ] || { echo "reset-nfc-reader: no CCID reader found" >&2; exit 1; }
-      '';
-    };
-  };
+  # The Feitian KP382 contactless reader (096e:0608) is declared as a machine
+  # capability, not here: `nfcReaderForModel` in flake.nix drives
+  # services.bitspire.nfc.enable, which owns pcscd, the polkit rules and the
+  # wedge-recovery unit (deploy/nixos/bitspire-atm.nix).
 
   # Disable suspend/hibernate for kiosk
   systemd.targets = {

deploy/nixos/hardware/upboard.nix

@@ -91,26 +91,9 @@
     cpuFreqGovernor = "performance";
   };
 
-  # PC/SC daemon for the HID Global OMNIKEY 5022 contactless reader
-  # (076b:5022, a CCID smart-card reader) used for Bolt Card tap-to-enter
-  # (ADR-003). pcscd binds the CCID driver; the app talks to pcscd's socket
-  # (via nfc-pcsc) rather than the USB device directly. Device-agnostic —
-  # same wiring as batm3's Feitian KP382; harmless if no reader is attached,
-  # pcscd just idles. Shared by every upboard machine (sintra, tejo).
-  services.pcscd.enable = true;
-
-  # pcscd gates client access via polkit; without a rule the sandboxed
-  # `bitspire` service user is "Rejected unauthorized PC/SC client". Authorize
-  # it to talk to the daemon and the card.
-  security.polkit.extraConfig = ''
-    polkit.addRule(function(action, subject) {
-      if ((action.id == "org.debian.pcsc-lite.access_pcsc" ||
-           action.id == "org.debian.pcsc-lite.access_card") &&
-          subject.user == "bitspire") {
-        return polkit.Result.YES;
-      }
-    });
-  '';
+  # No pcscd here. This file is shared by sintra (HID Global OMNIKEY 5022
+  # fitted) and tejo (no reader), so the reader is declared per model via
+  # `nfcReaderForModel` in flake.nix → services.bitspire.nfc.enable.
 
   # Disable suspend/hibernate for kiosk
   systemd.targets = {