feat: Add fingerprint scanner support and modularize work configurations

- Add fingerprint.nix hardware module with TOD driver support
- Create separate laptop-work configuration with Cisco, Himmelblau, and MDATP work modules
- Move work-specific modules from shared to laptop-work profile
- Change work module enable defaults to false for better security-by-default
- Add MDATP support with enhanced modular structure

system/hardware/fingerprint.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+# Fingerprint scanner configuration
+#
+# Enable on laptops with a fingerprint reader:
+#   hardware.fingerprint.enable = true;
+#
+# For some sensors (Goodix, Elan, Synaptics), you may also need to set
+# the TOD driver:
+#   hardware.fingerprint.todDriver = pkgs.libfprint-2-tod1-goodix;
+#
+# Reference: https://wiki.nixos.org/wiki/Fingerprint_scanner
+
+let
+  cfg = config.hardware.fingerprint;
+in {
+  options.hardware.fingerprint = {
+    enable = lib.mkEnableOption "fingerprint scanner support (fprintd)";
+
+    todDriver = lib.mkOption {
+      description = "Touch OEM Drivers (TOD) package to use for the fingerprint sensor";
+      type = lib.types.nullOr lib.types.package;
+      default = null;
+      example = lib.literalExpression "pkgs.libfprint-2-tod1-goodix";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.fprintd.enable = true;
+
+    services.fprintd.tod = lib.mkIf (cfg.todDriver != null) {
+      enable = true;
+      driver = cfg.todDriver;
+    };
+  };
+}