Lock screen: allow a generic PAM biometric provider (e.g. howdy) to run concurrently, like fprint does

## Summary

`Modules/Lock/Pam.qml` already runs fingerprint as an independent, concurrent `PamContext` that races against the password context — `fprint.start()` and `passwd.start()` both run in parallel, and whichever reaches `PamResult.Success` first wins (`fprint`'s `onCompleted` calls `passwd.abort()` and proceeds). There's no equivalent slot for other PAM-based biometric providers, e.g. [howdy](https://github.com/boltgolt/howdy) (IR-camera face recognition).

The only way to wire howdy into the lock screen today is to add `auth sufficient pam_howdy.so` to the same PAM stack the password context uses (`login`/the resolved `dankshell` service). Since PAM stacks evaluate modules synchronously in order, putting howdy first means the password prompt can't even be relayed to the conversation until howdy's module call returns — success or its configured timeout. In practice this means typing your password and pressing enter does nothing until the face-scan attempt (up to several seconds) finishes, even though you never intended to use it that time.

## Request

Add a generic secondary-biometric `PamContext` (or make the existing `fprint` context configurable to point at an arbitrary PAM service name) so providers like howdy can run the same way fingerprint does today: started concurrently alongside `passwd`, racing it, calling `passwd.abort()` on success. This would let face recognition run continuously in the background (including while the user is typing their password) without blocking password entry at all.

## Context

Reported from [sitolam/sitolamix](https://github.com/sitolam/sitolamix), a NixOS flake config that wires up howdy via `security.pam.services.login.howdy.enable` (bundled into the same stack as `pam_unix.so`). Happy to test a fix if one is added — currently working around it by lowering howdy's scan timeout to reduce (not eliminate) how long password entry is blocked.

Start in Modules/Lock/Pam.qml and trace how the existing fprint and passwd PamContext instances are started, raced, and aborted. Verify the concurrent success path, then add or configure a secondary biometric service so it runs alongside password entry without blocking it; done means a provider such as howdy can win the race and abort passwd like fprint does.

Written by the indexing model from the issue text.