system: fix kanidm PAM user mismatch

Configure uid_attr_map and gid_attr_map to use short names instead of
SPN format. This fixes SSH failing with "PAM user mismatch" because
getent returned "torjus@home.2rjus.net" instead of "torjus".

Also add user-management documentation.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

system/kanidm-client.nix

@@ -30,6 +30,9 @@ in
 
       unixSettings = {
         pam_allowed_login_groups = cfg.allowedLoginGroups;
+        # Use short names (e.g., "torjus") instead of SPN (e.g., "torjus@home.2rjus.net")
+        uid_attr_map = "name";
+        gid_attr_map = "name";
       };
     };
   };