refactor(canokey): rely on systemd uaccess rules instead of custom udev

systemd's 60-fido-id.rules marks the FIDO hidraw node and the CCID USB
device as security tokens, and 70-uaccess.rules grants them to the
active seat. Drop the hand-written rules and the plugdev membership.

Assisted-by: Claude Code (claude-opus-5-5)

modules/nixos/desktop/canokey.nix

@@ -2,7 +2,6 @@
   pkgs,
   config,
   lib,
-  myvars,
   ...
 }:
 let
@@ -14,27 +13,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # systemd tags FIDO/CCID devices uaccess (60-fido-id.rules); pcscd covers OpenPGP.
     services.pcscd.enable = true;
 
-    # The FIDO2 udev rule below hands the key to the plugdev group.
-    users.users.${myvars.username}.extraGroups = [ "plugdev" ];
-
-    services.udev.extraRules = ''
-      # CanoKey - GnuPG/pcsclite
-      SUBSYSTEM!="usb", GOTO="canokey_rules_end"
-      ACTION!="add|change", GOTO="canokey_rules_end"
-      ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", ENV{ID_SMARTCARD_READER}="1"
-      LABEL="canokey_rules_end"
-
-      # CanoKey - FIDO2
-      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", TAG+="uaccess", GROUP="plugdev", MODE="0660"
-
-      # CanoKey - WebUSB
-      # Upstream ships this as MODE:="0666" (world-writable), which lets any
-      # local user access the key; restrict it to the plugdev group instead.
-      SUBSYSTEMS=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="42d4", GROUP="plugdev", MODE="0660"
-    '';
-
     environment.systemPackages = with pkgs; [
       ccid
       pcsc-tools