Step 25: Real FIDO2 hardware key support.

HardwareFIDO2 implements FIDO2Device via go-libfido2 (CGo bindings to
Yubico's libfido2). Gated behind //go:build fido2 tag to keep default
builds CGo-free. Nix flake adds sgard-fido2 package variant.

CLI changes: --fido2-pin flag, unlockDEK helper tries FIDO2 first,
add-fido2/encrypt init --fido2 use real hardware, auto-unlock added
to restore/checkpoint/diff for encrypted entries.

Tested manually: add-fido2, add --encrypt, restore, checkpoint, diff
all work with hardware FIDO2 key (touch-to-unlock, no passphrase).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

garden/fido2_nohardware.go

@@ -0,0 +1,10 @@
+//go:build !fido2
+
+package garden
+
+// DetectHardwareFIDO2 is a stub that returns nil when built without the
+// fido2 build tag. Build with -tags fido2 and link against libfido2 to
+// enable real hardware support.
+func DetectHardwareFIDO2(_ string) FIDO2Device {
+	return nil
+}