fix+perf: audit fixes and GPU blur migration (v0.5.0)

Address all findings from quality, performance, and security audits:
- Filter greetd error descriptions consistently (security)
- Re-enable power buttons after failed action (UX bug)
- Narrow TOCTOU window in avatar loading via symlink_metadata (security)
- Allow @ in usernames for LDAP compatibility
- Eliminate unnecessary Vec allocation in passwd parsing
- Remove dead i18n field, annotate retained-for-future struct fields
- Fix if/if→if/else and noisy test output in power.rs

Replace CPU blur (image crate + disk cache + async orchestration) with
GPU blur via GskBlurNode — symmetric with moonlock and moonset.
Removes ~15 transitive dependencies and ~200 lines of caching code.

src/main.rs

@@ -55,7 +55,8 @@ fn activate(app: &gtk::Application) {
     log::debug!("Background path: {}", bg_path.display());
 
     // Load background texture once — shared across all windows
-    let bg_texture = greeter::load_background_texture(&bg_path, config.background_blur);
+    // Blur is applied on the GPU via GskBlurNode at widget realization time.
+    let bg_texture = greeter::load_background_texture(&bg_path);
     if bg_texture.is_none() {
         log::error!("Failed to load background texture — greeter will start without wallpaper");
     }
@@ -81,7 +82,7 @@ fn activate(app: &gtk::Application) {
                 .item(i)
                 .and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
             {
-                let wallpaper = greeter::create_wallpaper_window(texture, app);
+                let wallpaper = greeter::create_wallpaper_window(texture, config.background_blur, app);
                 setup_layer_shell(&wallpaper, false, gtk4_layer_shell::Layer::Bottom);
                 wallpaper.set_monitor(Some(&monitor));
                 wallpaper.present();