breadgreet: skip the username step, fix clobbered typography

Login UX
- Enumerate human accounts from /etc/passwd (UID_MIN..UID_MAX per
  /etc/login.defs, real login shell, minus nobody) and skip the
  username field: one account goes straight to the password prompt
  with the name shown, several get a picker. Zero found falls back to
  typing. New [user] config: `name` pins one account, `prompt = true`
  restores the type-it flow.
- The greeter opens the greetd conversation at startup in auto mode so
  it lands directly on the password prompt (AutoStart).
- reset_to_username -> reset_auth: auto mode re-opens the password
  prompt for the same account on error/Escape rather than showing a
  username field it never had.

Typography fix
- bind_window_auto re-broadcasts the shared component sheet (incl. its
  `* { font-size }` base rule) at USER-10, which outranks the
  APPLICATION-priority provider apply_app_css uses regardless of
  selector specificity -- so the hero clock and every other type
  override silently collapsed to base size. Ride breadgreet's sheet
  through bind_window_auto_with_app_css instead (USER-9), matching
  breadbar.

Polish
- Accent rule between the clock and card, drawn in via scaleX with a
  glow halo; card gradient + top highlight + deep shadow, bg-pop
  overshoot entrance, slow bg-breathe idle pulse; layered accent focus
  glow on the entry; gradient session/user pills. Entrance/idle motion
  is CSS @keyframes now (setup_entrance removed).
- Errors pinned to a legible red -- BOS's default @red slot is a warm
  ochre, unreadable as a warning.
- Drop the duplicate prompt text (placeholder + status line both said
  "Password:").

Preview harness
- scripts/preview.sh + scripts/mock-greetd.py run the real greeter in a
  nested Weston window against a stand-in greetd, so the whole flow
  (spinner, wrong-password shake, success) is drivable without a
  reboot. $BREADGREET_CONFIG overrides the config search path so a
  preview never touches /etc/greetd/breadgreet.toml.

breadgreet/scripts/preview.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Run breadgreet in a nested compositor window on your current desktop so you
+# can actually drive the UI — type a username, a password, watch the spinner,
+# get the shake on a wrong password — without touching your real greeter or
+# rebooting.
+#
+#   breadgreet/scripts/preview.sh            # cairo renderer (safe everywhere)
+#   breadgreet/scripts/preview.sh --gpu      # your default GSK renderer
+#   breadgreet/scripts/preview.sh --typed    # force the old type-the-username flow
+#
+# By default breadgreet enumerates your /etc/passwd users and skips straight to
+# the password prompt. Password is "bread"; any other password exercises the
+# auth-error path (shake + red status line). A correct login makes breadgreet
+# exit, as it would for real — that ends the script and closes the window.
+# Ctrl-C in this terminal tears everything down at any point.
+#
+# The nested compositor opens as an ordinary window; float / resize it with
+# your WM as you like (it fills whatever size it gets).
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo="$(cd "$here/../.." && pwd)"
+cd "$repo"
+
+renderer=cairo
+typed=0
+for arg in "$@"; do
+    case "$arg" in
+        --gpu) renderer="" ;;
+        --typed) typed=1 ;;
+        *) echo "unknown flag: $arg" >&2; exit 1 ;;
+    esac
+done
+
+if [[ -z "${WAYLAND_DISPLAY:-}" ]]; then
+    echo "no WAYLAND_DISPLAY — run this from inside your Wayland session" >&2
+    exit 1
+fi
+: "${XDG_RUNTIME_DIR:=/run/user/$(id -u)}"
+
+if ! command -v weston >/dev/null; then
+    echo "need 'weston' for the nested compositor (pacman -S weston)" >&2
+    exit 1
+fi
+
+echo ">> building breadgreet (debug)"
+cargo build -p breadgreet
+
+work="$(mktemp -d /tmp/breadgreet-preview.XXXXXX)"
+sock="$work/greetd.sock"
+conf="$work/breadgreet.toml"
+
+# A preview config (loaded via $BREADGREET_CONFIG, so the real
+# /etc/greetd/breadgreet.toml is left untouched). BOS ships breadgreet with a
+# flat colour background; this points at the BOS wallpaper + Ken Burns so you
+# can also see how a wallpapered greeter would look.
+wallpaper="$repo/../bos/iso/airootfs/usr/share/backgrounds/bos/bread-background.png"
+cat > "$conf" <<EOF
+[background]
+mode = "$([[ -f "$wallpaper" ]] && echo image || echo color)"
+path = "$wallpaper"
+ken_burns = true
+
+[clock]
+format = "%H:%M"
+date_format = "%A, %B %-d"
+
+[font]
+family = "Varela Round"
+EOF
+[[ "$typed" == 1 ]] && printf '\n[user]\nprompt = true\n' >> "$conf"
+
+wl_sock="breadgreet-preview-$$"
+pids=()
+cleanup() {
+    for p in "${pids[@]:-}"; do kill "$p" 2>/dev/null || true; done
+    sleep 0.3
+    for p in "${pids[@]:-}"; do kill -9 "$p" 2>/dev/null || true; done
+    rm -rf "$work"
+}
+trap cleanup EXIT INT TERM
+
+echo ">> starting mock greetd"
+python3 "$here/mock-greetd.py" "$sock" bread &
+pids+=($!)
+for _ in $(seq 1 40); do [[ -S "$sock" ]] && break; sleep 0.1; done
+
+echo ">> starting nested compositor"
+weston --width=1400 --height=900 --socket="$wl_sock" >"$work/weston.log" 2>&1 &
+pids+=($!)
+for _ in $(seq 1 60); do [[ -S "$XDG_RUNTIME_DIR/$wl_sock" ]] && break; sleep 0.1; done
+
+echo ">> launching breadgreet  (password: bread)"
+[[ -n "$renderer" ]] && export GSK_RENDERER="$renderer"
+WAYLAND_DISPLAY="$wl_sock" \
+    BREADGREET_CONFIG="$conf" \
+    GREETD_SOCK="$sock" \
+    "$repo/target/debug/breadgreet" || true
+
+echo ">> breadgreet exited"