Lucid v1.1.0 — lock screen, polkit, accounts and light mode

Everything the shell asks you for, it now asks for itself: a lock screen that
checks your password through PAM, the administrator prompt for the whole
machine, the accounts on it, and a login screen wearing the same palette. Around
that, a notification centre that groups and replies, clipboard history in the
launcher, a keyboard you can type with when there is not one, and a light mode
built rather than inverted.

Lock screen

• The lock screen is rebuilt from scratch. The old single 1000x600 card
  packed with weather, disk charts, CPU and RAM graphs and a fastfetch dump is
  gone. In its place the content floats on the wallpaper the way Material You
  lays out a lock screen: an oversized two-line clock in the wallpaper's own
  accent colour on the left, the weather above it, the glanceable chips top
  right, and a right-hand column carrying the sign-in card, what is playing and
  the notifications.
• It authenticates through PAM. The old screen shelled out to
  sudo -S -v, which only worked for accounts that happen to be sudoers and
  told you nothing when it failed. The lock now opens a real PAM session
  against /etc/pam.d/login — the same service a display manager uses — so any
  account can unlock, and PAM's own words are what you read when something goes
  wrong. A second question from PAM (a token, a second factor) reopens the
  field with PAM's prompt on it rather than dead-ending.
• The refusals say something useful. "Incorrect password — 2 tries left"
  counting down against faillock's real deny, "Too many attempts — try again
  in 8 minutes" with the countdown read from faillock itself, "The check
  timed out" when PAM stops answering, and PAM's own sentence when it has one.
• Caps Lock gets its own badge next to the field, so the commonest reason a
  password is refused stays visible even while a refusal is on screen. The
  active keyboard layout shows beside it when you are typing.
• Two faces, one screen. Resting, the lock is a glance: clock, date,
  greeting, weather, media, notifications. Touch the keyboard and it focuses —
  the wallpaper blurs further, the clock shrinks out of the way, everything
  that is not the field steps back, and the sign-in card is all that is lit.
  It drifts back to the glance after half a minute of quiet.
• The password field is an M3 outlined field: a focus ring in the accent,
  beads that pop in per character, a reveal toggle, and a submit button that
  turns into a proper indeterminate spinner while PAM thinks and a tick when it
  opens. The lock glyph turns over on success; the pill and the avatar's ring
  go green, or red and shake.
• Power actions ask first. Log out, restart and shut down morph the bar
  into a confirmation instead of going straight through; suspend and hibernate
  still go immediately. The question withdraws itself after seven seconds.
  Hovering one opens it into its own labelled pill inside the bar — the glyph
  stays put, the bar grows around it — rather than floating a tooltip over the
  wallpaper.
• A caret you can steer. The beads are not just a count: a caret sits where
  the next character will land, and the arrow keys walk it back through what is
  already typed so a single character can be fixed instead of starting over.
  Each new bead is left behind by that caret — it starts as the caret's own
  line and settles into a dot where it stood.
• Clicking away puts the lock back to rest. Anywhere off the sign-in card
  drops the focus, forgets what was half-typed and clears any refusal still on
  screen; the card itself counts as inside, so clicking the avatar aims the
  keyboard at the field instead.
• Notifications on the lock cannot reach past it. Their action buttons and
  inline reply are hidden, and Notifs refuses to invoke an action or send a
  reply while the session is locked, so no card can launch or talk to an
  application from the lock screen.
• Every other screen gets the clock, not a second password field.
• Arriving and leaving are different gestures. The entrance is a staggered
  wave read off a single number: the wallpaper settles out of a push-in and
  blurs, the clock rises in from the left, and the right-hand cards slide in
  one after another. Leaving is not that run backwards — the whole stage leans
  forward and dissolves at once while the wallpaper comes back into focus.
• New layout of the code. Lockscreen.qml is a root singleton holding the
  session state, PAM, the attempt ledger and the IPC; lucidlock/ is eleven
  small views instead of one 3000-line file. lucidlock/BlurBackdrop.qml, which
  nothing had used for a long time, is gone.
• qs ipc call -- lock keeps lock, unlock and isLocked, and gains
  status (the session state as JSON). Nothing bypasses the password: the
  scaffolding used while the screen was being built — a dry-run mode, and
  handles that could force a verdict — is gone, so PAM is the only way in.

Authentication

• Lucid is the session's polkit agent. Anything on the machine that needs
  an administrator — mounting a disk, changing the time zone, installing a
  package, pkexec, the Users page — now asks through a Lucid dialog instead
  of the KDE one. Only the dialog is ours: polkitd still decides what needs
  authorising and PAM still checks the password, through polkit's own setuid
  helper. Nothing about the security model changes.
• The dialog says what is actually being asked. A badge glyph picked from
  the action itself (a disk for udisks, a power symbol for logind, a terminal
  for pkexec, a parcel for package installs), the action's short description
  from pkaction as the headline, and polkit's own sentence underneath —
  retyped out of its `like this' quoting into real quotation marks.
• It shows whose password it wants. Every identity polkit will accept is
  listed with the name and picture from the Users page, and when there is more
  than one, picking a different administrator re-points the request at them.
• The field is the lock screen's field — the same pill, focus ring and
  reveal toggle — so a password prompt looks the same wherever the shell asks
  for one. A refusal tints the pill, shakes it and says what PAM said; a grant
  shows a tick before it leaves.
• Escape, the Cancel button and a click on the dimmer all dismiss the request
  properly, so whatever asked is told it was refused rather than left waiting.
  The dialog holds the keyboard only while a request is actually live.

Users and accounts

• The settings app manages the machine's user accounts. A card at the top of
  the navigation rail shows your picture and name and opens a new Users and
  Accounts page, where every account on the machine is listed and picking one
  points the whole page at it.
• Full name, username, account type, login shell, email and location are all
  editable, with the guards that matter: the last administrator cannot demote
  themselves, an account that is signed in cannot be renamed, and you cannot
  lock or clear the password of the account you are using.
• Passwords are set through a dialog that checks the two entries match and
  rates what you typed, and a password hint can be left alongside. An account
  can instead be told to choose its own password at its next sign-in.
• Accounts can be added and removed. Adding asks for a name, guesses the
  username from it, and offers to set the first password now or leave it for
  first sign-in. Removing makes the files a separate, explicit decision from the
  account itself.
• Account pictures can be chosen from the machine's stock faces or any image
  on disk; it is centre-cropped and scaled to 256 px, saved to ~/.face for
  your own account so the lock screen finds it, and can be removed again to fall
  back to initials on a tonal disc.
• Supplementary groups — audio, video, libvirt and the like — are shown as
  chips you can toggle, batched into one authorisation rather than one per group.
• Everything privileged goes through AccountsService on the system bus, so the
  session's polkit agent does the asking and the shell never runs as root. A
  refused or cancelled prompt is reported on the page instead of failing
  silently. Requires accountsservice, now declared in the installer.
• Account pictures keep a history. Changing your picture files the old one
  away rather than losing it, and the picker shows what the account wore
  before, newest first — clicking one puts it back. Removing a picture keeps it
  too, so going back to initials is never a one-way door.
• The shelf holds twelve pictures or 8 MB, whichever runs out first, and the
  oldest drop off as new ones arrive. Pictures are stored by what they look
  like, so re-applying one already there just moves it to the front instead of
  filing a second copy. Clear empties the whole shelf.
• The history lives in your own data directory, so reading it never asks for an
  administrator.
• Passwords now need four characters rather than six, in the password
  dialog and when adding an account. The strength read-out is unchanged, so a
  short password is allowed but still reads as weak.
• Fixed: a face directory's own hidden fallback silhouette (SDDM ships one as
  .face.icon) was being offered as a stock picture, showing up as an empty
  black circle in the picker.

Notifications

• The notification centre is rebuilt. One place now owns every notification
  in the shell — the pill on the bar, the popups and the lock screen are three
  views onto the same list, so dismissing something dismisses it everywhere and
  Do Not Disturb means the same thing wherever you turn it on.
• Notifications group by application. Five messages from one chat collapse
  into a single stack with the application's name on it; open it to read them,
  clear it to drop the lot. A heading separates what has just arrived from the
  rest, and...