Add lock-screen status line and harden the locker

Show MPRIS now-playing and upower battery under the clock, polled on a
background thread (zbus). Flags gate both drawing and D-Bus; desktops
without a battery stay blank; titles are truncated.

Also the locker audit pass that landed in the same files:
- PAM authenticates getuid()/getpwuid_r, not $USER, and missing
  username still takes the lock
- one lock surface per output, generation-gated fail timers, PAM
  timeout, Tab-reveal off by default and cleared on keyboard leave
- GPU chrome is a dirty-rect quad with EGL cleanup; shm reuses a
  SlotPool; appear/shake/flash/veil/clock-crossfade bugs
- hold-to-reveal, checking ellipsis, and password display length

Live-checked on hermes (GPU path, PAM unlock, Tab-hold).

breadlock-ui/Cargo.toml

@@ -14,7 +14,6 @@ toml.workspace = true
 # instead, so it builds without pulling these in).
 tiny-skia = { version = "0.12", optional = true }
 cosmic-text = { version = "0.14", optional = true }
-chrono = { version = "0.4", optional = true }
 
 [features]
-paint = ["dep:tiny-skia", "dep:cosmic-text", "dep:chrono"]
+paint = ["dep:tiny-skia", "dep:cosmic-text"]