Add caps-lock chip, hold-to-reveal, idle auto-dim, and attempt counter

Four lock-screen niceties:
- Caps Lock / layout chip: a small pill above the password pill shows
  when Caps Lock is on or a non-default layout is selected, so all-caps
  input never mystifies.
- Hold-to-reveal: holding Tab renders the plain password instead of
  dots (Tab produces no utf8, so it can never be part of the password).
- Idle auto-dim: after `animation.idle_dim_after_secs` of no keystrokes
  the dim veil deepens past the base gradient (background-only alpha can
  legally exceed 1.0), ramping over a few seconds for OLED/burn-in
  comfort. Shared `veil_alpha` keeps software and GPU paths identical.
- Attempt counter: repeat failures show "Wrong password — N failed
  attempts" so a stuck locker reads differently from ordinary typos.

All four render paths covered by tests (veil math, reveal truncation,
chip/reveal compose) and live-verified in nested Hyprland on the GPU
path; idle dim confirmed to deepen the veil (84.5->75.8 top).

breadlock.example.toml

@@ -26,7 +26,14 @@ family = "Varela Round"
 # How long the "wrong password" state (red pill) shows before input
 # re-enables, in milliseconds.
 fail_timeout_ms = 800
+# Hold Tab to reveal the typed password as plain characters (instead of
+# dots) while held. Tab can never be part of a password, so it's always
+# safe as a reveal gesture.
+reveal_hold = true
 
 [animation]
 # Subtle glow pulse on the password pill every few seconds while idle.
 breathe = true
+# Deepen the dim veil after this many seconds of no keystrokes (0 = off).
+# A gentle extra darkening for OLED/burn-in or late-night comfort.
+idle_dim_after_secs = 0