feat(pkg): autostart .desktop entry running authforge --first-run on GNOME login

GNOME-only autostart entry installed to /etc/xdg/autostart/. Uses
X-GNOME-Autostart-Phase=Initialization so it runs before user
autostarts but after GDM hands the session off. NoDisplay=true keeps
it out of the apps menu — autostart-only.

Plan deviation: project uses debian/rules for installation (no
debian/authforge-gui.install file exists), so the install line goes
there instead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

debian/rules

@@ -23,6 +23,11 @@ override_dh_auto_install:
 	    debian/authforge-gui/usr/share/applications/io.dangerousthings.AuthForge.desktop
 	install -D -m 0644 gui/data/io.dangerousthings.AuthForge.svg \
 	    debian/authforge-gui/usr/share/icons/hicolor/scalable/apps/io.dangerousthings.AuthForge.svg
+	# First-run autostart entry (Phase 10): runs `authforge --first-run`
+	# at GNOME session start; binary exits ~immediately when no pending
+	# flag is set, so the per-session cost is one D-Bus round-trip.
+	install -D -m 0644 gui/data/authforge-firstrun.desktop \
+	    debian/authforge-gui/etc/xdg/autostart/authforge-firstrun.desktop
 	# PAM
 	$(MAKE) -C pam install DESTDIR=$(CURDIR)/debian/authforge-pam
 	# D-Bus activation file

gui/data/authforge-firstrun.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=AuthForge First-Run Setup
+Comment=Prompts new users to enroll a security key.
+Exec=authforge --first-run
+NoDisplay=true
+OnlyShowIn=GNOME;
+X-GNOME-Autostart-Phase=Initialization
+X-GNOME-Autostart-enabled=true