fix(security): tighten desktop remote access

outputs/aarch64-linux/tests/security-ssh-x11/expected.nix

@@ -3,5 +3,12 @@
   outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
-  name: name == "ai-niri" || name == "shoukei-niri"
+  name:
+  let
+    isDesktop = name == "ai-niri" || name == "shoukei-niri";
+  in
+  {
+    X11Forwarding = isDesktop;
+    PermitRootLogin = if isDesktop then "no" else "prohibit-password";
+  }
 )

outputs/aarch64-linux/tests/security-ssh-x11/expr.nix

@@ -3,5 +3,11 @@
   outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
-  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+  name:
+  let
+    settings = outputs.nixosConfigurations.${name}.config.services.openssh.settings;
+  in
+  {
+    inherit (settings) PermitRootLogin X11Forwarding;
+  }
 )