feat: Add fingerprint scanner support and modularize work configurations

- Add fingerprint.nix hardware module with TOD driver support
- Create separate laptop-work configuration with Cisco, Himmelblau, and MDATP work modules
- Move work-specific modules from shared to laptop-work profile
- Change work module enable defaults to false for better security-by-default
- Add MDATP support with enhanced modular structure

work/cisco.nix

@@ -17,7 +17,7 @@ let
 in {
   options.work.cisco = {
     enable = lib.mkEnableOption "Cisco Secure Client" // {
-      default = true;
+      default = false;
     };
 
     package = lib.mkOption {

work/default.nix

@@ -3,6 +3,7 @@
     ./overlay.nix
     ./cisco.nix
     ./himmelblau.nix
+    ./mdatp.nix
   ];
 
   # Create the work directory for the user

work/himmelblau.nix

@@ -18,9 +18,13 @@
 let
   cfg = config.work.himmelblau;
 in {
+  imports = [
+    inputs.himmelblau.nixosModules.himmelblau
+  ];
+
   options.work.himmelblau = {
     enable = lib.mkEnableOption "Himmelblau Entra ID authentication" // {
-      default = true;
+      default = false;
     };
   };
 

work/mdatp.nix

@@ -0,0 +1,22 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# Microsoft Defender for Endpoint
+#
+# References:
+#   - https://github.com/epetousis/nix-mdatp
+
+let
+  cfg = config.work.mdatp;
+in {
+  imports = [
+    inputs.mdatp.nixosModules.mdatp
+  ];
+
+  options.work.mdatp = {
+    enable = lib.mkEnableOption "Microsoft Defender for Endpoint";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.mdatp.enable = true;
+  };
+}