Reorganize desktop roles: extract common bootstrap and host-specific layers

- Add profile_desktop_common with shared desktop bootstrap (emptty, PAM,
  dotfiles, templates, GPG, Maildir, Flatpak, st, external tools)
- Add profile_desktop_host with host-specific tasks (NVIDIA/PRIME on nymph)
- Reduce profile_desktop_i3 to i3/X11-only tasks
- Create profile_desktop_hyprland for Hyprland Wayland session
- Add dual-session support (i3 + Hyprland) on nymph with session choice
- Create shared Hyprland/Waybar dotfiles under dotfiles/desktop/
- Fix Waybar: bottom position, no persistent workspaces, sort by number
- Rename host_dotfiles to host_i3_dotfiles for clarity
- Make emptty restart manual by default to avoid session drops

dotfiles/desktop/.local/bin/lock-session

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -eu
+
+case "${XDG_CURRENT_DESKTOP:-}" in
+  *Hyprland*|*hyprland*)
+    exec hyprlock
+    ;;
+  *i3*|*I3*)
+    exec "$HOME/.config/i3/scripts/lockscreen"
+    ;;
+esac
+
+if command -v hyprlock >/dev/null 2>&1; then
+  exec hyprlock
+fi
+
+if [ -x "$HOME/.config/i3/scripts/lockscreen" ]; then
+  exec "$HOME/.config/i3/scripts/lockscreen"
+fi
+
+printf '%s\n' 'No supported lock command found.' >&2
+exit 1