feat(auth): Boot-time login prompt; fix(configure): arch selection via dialog

Login:
- Add console_login() (security/auth.c): an interactive boot-time username /
  password gate rendered on the framebuffer console before any session starts.
  It blocks until valid credentials are entered, masks the password, scrubs it
  from the stack, and sets the current user. Default account is SUB / SUB, shown
  as a hint. Wired into the boot handoff in kernel/main.c ahead of both the GUI
  desktop and the emergency TTY shell.

Configure:
- scripts/kconfig/menuconfig.py: fix the architecture (and optimization) picker.
  The lxdialog front-end used --radiolist, where <Enter> confirms the ORIGINAL
  choice and only <Space> moves the dot -- so highlighting a new architecture
  and pressing <Enter> appeared to do nothing. Single-choice groups now use
  --menu (with --default-item), where <Enter> selects the highlighted row
  directly. Also stop the unconditional save-on-exit from overriding an explicit
  "No" at the exit confirmation.

Verified: SUB/SUB logs in (injected via QEMU monitor) -> "Login successful" ->
desktop starts; the desktop stays blocked until login. dialog --menu selection
of aarch64 persists to .config/autoconf.h and retargets `make`. Clean build on
x86_64/aarch64/armv8i.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

kernel/main.c

@@ -275,20 +275,25 @@ static void subos_modular_core_boot(void) {
     bool emergency_text = init_has_param("nogui") || init_has_param("text") ||
                           init_has_param("emergency") || init_has_param("single");
 
+    // End the splash and return the screen to a text console so the login
+    // prompt is visible before any session (graphical or TTY) begins.
+    boot_logo_splash_end();
+    fbcon_enable(true);
+
+    // Gate the session behind an interactive login. This blocks until a valid
+    // username/password is entered; the default account is SUB / SUB.
+    console_login();
+
     if (!emergency_text) {
-        printk(KERN_INFO "INIT: Booting directly into SUB-OS Graphical Desktop Environment...\n");
-        boot_logo_splash_end();
+        printk(KERN_INFO "INIT: Starting SUB-OS Graphical Desktop Environment...\n");
         gui_start_desktop();
-        printk(KERN_INFO "INIT: GUI session closed. Entering Emergency Kernel TTY Mode.\n");
+        printk(KERN_INFO "INIT: GUI session closed. Entering Kernel TTY Mode.\n");
+        // The desktop owned the framebuffer; return it to the text console.
+        fbcon_enable(true);
     } else {
         printk(KERN_INFO "INIT: Emergency text/kernel TTY mode requested via boot parameters.\n");
-        boot_logo_splash_end();
     }
 
-    // The screen returns to the console before handing over to userland, whether
-    // the GUI session just closed or a text boot was requested.
-    fbcon_enable(true);
-
     // Hand control to userland: /sbin/init is a separate static ELF that runs
     // in ring 3 with its own page tables and talks back only through INT 0x80.
     exec_run_builtin_init();