breadgreet: skip the username step, fix clobbered typography

Login UX
- Enumerate human accounts from /etc/passwd (UID_MIN..UID_MAX per
  /etc/login.defs, real login shell, minus nobody) and skip the
  username field: one account goes straight to the password prompt
  with the name shown, several get a picker. Zero found falls back to
  typing. New [user] config: `name` pins one account, `prompt = true`
  restores the type-it flow.
- The greeter opens the greetd conversation at startup in auto mode so
  it lands directly on the password prompt (AutoStart).
- reset_to_username -> reset_auth: auto mode re-opens the password
  prompt for the same account on error/Escape rather than showing a
  username field it never had.

Typography fix
- bind_window_auto re-broadcasts the shared component sheet (incl. its
  `* { font-size }` base rule) at USER-10, which outranks the
  APPLICATION-priority provider apply_app_css uses regardless of
  selector specificity -- so the hero clock and every other type
  override silently collapsed to base size. Ride breadgreet's sheet
  through bind_window_auto_with_app_css instead (USER-9), matching
  breadbar.

Polish
- Accent rule between the clock and card, drawn in via scaleX with a
  glow halo; card gradient + top highlight + deep shadow, bg-pop
  overshoot entrance, slow bg-breathe idle pulse; layered accent focus
  glow on the entry; gradient session/user pills. Entrance/idle motion
  is CSS @keyframes now (setup_entrance removed).
- Errors pinned to a legible red -- BOS's default @red slot is a warm
  ochre, unreadable as a warning.
- Drop the duplicate prompt text (placeholder + status line both said
  "Password:").

Preview harness
- scripts/preview.sh + scripts/mock-greetd.py run the real greeter in a
  nested Weston window against a stand-in greetd, so the whole flow
  (spinner, wrong-password shake, success) is drivable without a
  reboot. $BREADGREET_CONFIG overrides the config search path so a
  preview never touches /etc/greetd/breadgreet.toml.

breadgreet/scripts/mock-greetd.py

@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""A stand-in greetd for previewing breadgreet without a real session.
+
+Speaks the greetd IPC wire format (`u32` native-endian length prefix + JSON
+body, see the `greetd_ipc` crate) on a Unix socket. It never touches PAM and
+never starts anything — `start_session` just acknowledges and the greeter
+exits, exactly as it would on a real login.
+
+    ./mock-greetd.py /run/user/1000/breadgreet-preview.sock [password]
+
+Default password is "bread"; any other answer gets the auth-error path so you
+can see the shake + red status line.
+"""
+
+import json
+import os
+import socket
+import struct
+import sys
+
+PASSWORD = sys.argv[2] if len(sys.argv) > 2 else "bread"
+
+
+def read_frame(conn):
+    hdr = b""
+    while len(hdr) < 4:
+        chunk = conn.recv(4 - len(hdr))
+        if not chunk:
+            return None
+        hdr += chunk
+    (length,) = struct.unpack("=I", hdr)
+    body = b""
+    while len(body) < length:
+        chunk = conn.recv(length - len(body))
+        if not chunk:
+            return None
+        body += chunk
+    return json.loads(body)
+
+
+def send(conn, obj):
+    body = json.dumps(obj).encode()
+    conn.sendall(struct.pack("=I", len(body)) + body)
+
+
+def handle(conn):
+    while True:
+        req = read_frame(conn)
+        if req is None:
+            return
+        kind = req.get("type")
+        if kind == "create_session":
+            print(f"  create_session  username={req.get('username')!r}")
+            send(conn, {
+                "type": "auth_message",
+                "auth_message_type": "secret",
+                "auth_message": "Password: ",
+            })
+        elif kind == "post_auth_message_response":
+            if req.get("response") == PASSWORD:
+                print("  auth ok -> success")
+                send(conn, {"type": "success"})
+            else:
+                print("  auth bad -> auth_error")
+                send(conn, {
+                    "type": "error",
+                    "error_type": "auth_error",
+                    "description": "Login incorrect",
+                })
+        elif kind == "start_session":
+            print(f"  start_session   cmd={req.get('cmd')}")
+            send(conn, {"type": "success"})
+        elif kind == "cancel_session":
+            print("  cancel_session")
+            send(conn, {"type": "success"})
+        else:
+            print(f"  ?? {req}")
+            send(conn, {
+                "type": "error",
+                "error_type": "error",
+                "description": f"mock-greetd: unknown request {kind}",
+            })
+
+
+def main():
+    sys.stdout.reconfigure(line_buffering=True)
+    if len(sys.argv) < 2:
+        sys.exit(f"usage: {sys.argv[0]} <socket-path> [password]")
+    path = sys.argv[1]
+    try:
+        os.unlink(path)
+    except FileNotFoundError:
+        pass
+    srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    srv.bind(path)
+    srv.listen(1)
+    print(f"mock-greetd listening on {path}  (password: {PASSWORD!r})")
+    try:
+        while True:
+            conn, _ = srv.accept()
+            with conn:
+                handle(conn)
+    except KeyboardInterrupt:
+        pass
+    finally:
+        srv.close()
+        try:
+            os.unlink(path)
+        except FileNotFoundError:
+            pass
+
+
+if __name__ == "__main__":
+    main()

breadgreet/scripts/preview.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Run breadgreet in a nested compositor window on your current desktop so you
+# can actually drive the UI — type a username, a password, watch the spinner,
+# get the shake on a wrong password — without touching your real greeter or
+# rebooting.
+#
+#   breadgreet/scripts/preview.sh            # cairo renderer (safe everywhere)
+#   breadgreet/scripts/preview.sh --gpu      # your default GSK renderer
+#   breadgreet/scripts/preview.sh --typed    # force the old type-the-username flow
+#
+# By default breadgreet enumerates your /etc/passwd users and skips straight to
+# the password prompt. Password is "bread"; any other password exercises the
+# auth-error path (shake + red status line). A correct login makes breadgreet
+# exit, as it would for real — that ends the script and closes the window.
+# Ctrl-C in this terminal tears everything down at any point.
+#
+# The nested compositor opens as an ordinary window; float / resize it with
+# your WM as you like (it fills whatever size it gets).
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo="$(cd "$here/../.." && pwd)"
+cd "$repo"
+
+renderer=cairo
+typed=0
+for arg in "$@"; do
+    case "$arg" in
+        --gpu) renderer="" ;;
+        --typed) typed=1 ;;
+        *) echo "unknown flag: $arg" >&2; exit 1 ;;
+    esac
+done
+
+if [[ -z "${WAYLAND_DISPLAY:-}" ]]; then
+    echo "no WAYLAND_DISPLAY — run this from inside your Wayland session" >&2
+    exit 1
+fi
+: "${XDG_RUNTIME_DIR:=/run/user/$(id -u)}"
+
+if ! command -v weston >/dev/null; then
+    echo "need 'weston' for the nested compositor (pacman -S weston)" >&2
+    exit 1
+fi
+
+echo ">> building breadgreet (debug)"
+cargo build -p breadgreet
+
+work="$(mktemp -d /tmp/breadgreet-preview.XXXXXX)"
+sock="$work/greetd.sock"
+conf="$work/breadgreet.toml"
+
+# A preview config (loaded via $BREADGREET_CONFIG, so the real
+# /etc/greetd/breadgreet.toml is left untouched). BOS ships breadgreet with a
+# flat colour background; this points at the BOS wallpaper + Ken Burns so you
+# can also see how a wallpapered greeter would look.
+wallpaper="$repo/../bos/iso/airootfs/usr/share/backgrounds/bos/bread-background.png"
+cat > "$conf" <<EOF
+[background]
+mode = "$([[ -f "$wallpaper" ]] && echo image || echo color)"
+path = "$wallpaper"
+ken_burns = true
+
+[clock]
+format = "%H:%M"
+date_format = "%A, %B %-d"
+
+[font]
+family = "Varela Round"
+EOF
+[[ "$typed" == 1 ]] && printf '\n[user]\nprompt = true\n' >> "$conf"
+
+wl_sock="breadgreet-preview-$$"
+pids=()
+cleanup() {
+    for p in "${pids[@]:-}"; do kill "$p" 2>/dev/null || true; done
+    sleep 0.3
+    for p in "${pids[@]:-}"; do kill -9 "$p" 2>/dev/null || true; done
+    rm -rf "$work"
+}
+trap cleanup EXIT INT TERM
+
+echo ">> starting mock greetd"
+python3 "$here/mock-greetd.py" "$sock" bread &
+pids+=($!)
+for _ in $(seq 1 40); do [[ -S "$sock" ]] && break; sleep 0.1; done
+
+echo ">> starting nested compositor"
+weston --width=1400 --height=900 --socket="$wl_sock" >"$work/weston.log" 2>&1 &
+pids+=($!)
+for _ in $(seq 1 60); do [[ -S "$XDG_RUNTIME_DIR/$wl_sock" ]] && break; sleep 0.1; done
+
+echo ">> launching breadgreet  (password: bread)"
+[[ -n "$renderer" ]] && export GSK_RENDERER="$renderer"
+WAYLAND_DISPLAY="$wl_sock" \
+    BREADGREET_CONFIG="$conf" \
+    GREETD_SOCK="$sock" \
+    "$repo/target/debug/breadgreet" || true
+
+echo ">> breadgreet exited"