Enable sudo via fingerprint

lib/mksystem.nix

@@ -123,6 +123,13 @@ in
       ]
       ++ nixpkgs.lib.optionals darwin [
         inputs.nix-index-database.darwinModules.nix-index
+        {
+          # auth sudo via fingerprint
+          security.pam.services.sudo_local = {
+            reattach = true;
+            touchIdAuth = true;
+          };
+        }
       ]
       ++ custom;
   }